Cyber-Ark | Archive | Uncategorized

IT Security Rewind – Week of January 30, 2012

Posted on February 6, 2012 by Josh Arrington

At Cyber-Ark we don’t typically like to brag about our achievements, but we have had such a great week that we can’t help but show off a bit. This year we have been shortlisted for not one, not two, not even three but FOUR SC Magazine Europe Awards! We are very excited and wanted to send our congratulations to all of the finalists that were also shortlisted in the Best IAM Solution, Best Remote Access, Best Security Management and Information Security Product of the Year Categories. While we’ve been celebrating we’ve also been paying close attention to some evolving stories in cyber legislation as well as an interesting twist on a phone hacking and wanted to put stories out there to get our readers’ opinions:

Bloomberg Businessweek reported that the Cyber-Security bill has been delayed in reaching a vote on the Senate floor. The Senate bill would authorize the Homeland Security Department to identify infrastructure that’s “considered critical to U.S. economic and national security” and develop standards that must be met to protect them. Understanding the security threat that cyber war poses on our nation and the number of sophisticated hackers out there, advisors are doing their best educate the Senate on the urgency behind this bill. Bruce McConnell, a counselor to Napolitano on cyber security matters stated, “What we were here today to do was make sure the Senate understands the severity and importance of the threats that we’re facing and the need for action.”

Trying to hide your organization’s data breach? VeriSign proved this week that you can actually get away with it. After scouring 2,000 SEC filings Reuters reported this week that VeriSign was actually hit by hackers back in 2010 but did not report the breach until their SEC filing in October of 2011. How is this possible when the company states that “more than half (56%) of the world’s DNS hosts rely on the VeriSign .net and .com infrastructure”? Well, as long as credit card data isn’t involved organizations actually aren’t forced by the government to reveal a breach to the public.

Finally, FOX News and other outlets reported that a phone call between the FBI and Scotland Yard was recorded and released online by the hackers in Anonymous. Luckily, the FBI said that there was no classified information on the call, but it was still accessed illegally. Anonymous tweeted that they were able to hack the phone call by compromising an investigator’s emails. If the call is authentic, it is quite jarring that the group was able to hack into the very call that discussed proceedings for past offenses.

We’d love to get your thoughts on these legislative issues as well as the phone hacking – do you think the Senate is taking the threat of cyber war seriously? Should VeriSign have been forced by law to reveal that they were breached? Is Anonymous a bigger threat than we anticipated?

Let us know in the comments!

IT Security Rewind – Week of January 9

Posted on January 13, 2012 by Josh Arrington

Cyber-Ark Predicts: What’s Next on the Privileged Horizon

Posted on December 15, 2011 by Andrey Dulkin

Over the past year we’ve witnessed several spectacular attacks that demonstrated just how dangerous cyber criminals have become. These attacks have emphasized that a narrow focus on protecting against the insider threat is short-sighted and that more preventative approaches are needed to guard against external, highly targeted and persistent attacks that focus on high value information such as customer data and intellectual property. In taking stock of the threat landscape and emerging IT trends, we’ve summarized three key areas that we think will evolve significantly in the coming year, both in terms of technology innovation and risk.

Targeted Attacks: Preventative Protection on the Rise

As an industry, we’ve seen attacks move from opportunistic to increasingly sophisticated and targeted (think Stuxnet), with privileged access rights as a consistently – and perhaps increasingly – popular attack vector. Privileged accounts have proven to be a ‘sweet spot’ for attackers because of the broad, often anonymous access they provide to high value targets. However, many organizations are still in the early stages of identifying and solving privileged account weaknesses, including those caused by hard-coded passwords, which provides attackers with an extended window of opportunity.

That said, in the coming year we strongly believe that there will be a rise in more preventative approaches to protecting privileged accounts, including better isolation, access control and activity recording. This is due in part to greater awareness, increasing regulations and adoption of best practices, which are all driving significant growth for the privileged identity management market as a whole, and ultimately will help drive down the popularity of privileged accounts as an attack mechanism.

As strong indicators for the increasing need for more proactive privileged account management, consider that as a result of the changing threat landscape that the SANS Institute announced a major update to its 20 Critical Controls earlier this year. The 20 Critical Controls is a prioritized baseline of information security measures designed to provide continuous monitoring to better protect government and commercial computers and networks from cyber attacks. Several are directly related to privileged accounts: #8 Controlled Use of Administrative Privileges; #9 Controlled Access Based on the Need to Know and #11 Account Monitoring and Control.

Similarly, in the most recent NIST 800-53 publication that provides the recommended security controls for federal information systems and organizations, there is an emphasis establishing a proactive, preventative approach to privileged account management to achieve FISMA compliance.

SCADA Systems Under Attack: Vulnerabilities Continue to Put Critical Infrastructure at Risk

From weapons systems and water pumps to prison gates, systems not previously considered vulnerable to attack showed up in news headlines over past year. Those attacks have generated visibility for the fact that many of those systems were not designed with security in mind. Because of the hard-coded or weak/rarely changed passwords in tools like programmable logic controllers or SCADA software, those targets have become accessible to attackers, potentially putting critical infrastructure at risk.

With repeated attacks on the horizon, and building awareness, we expect that in 2012 there will be a notable increase in research dedicated to examining how hardware can be attacked by software, and the use of code to execute attacks particularly in the energy and utilities space. One early indicator that more research and solutions are needed may be statements made earlier this year by the U.S. Department of Homeland Security that said it was reevaluating whether it makes sense to warn the public about all of the security failings of industrial control system (ICS) and SCADA software – considering re-categorizing design flaws vs. security holes.

One of the main challenges with SCADA systems is that even when knowing about specific vulnerabilities, the cycles to fix them are so slow that it often makes more sense to try and keep the vulnerability confidential so attackers won’t exploit it during the lengthy repair period (remember “security by obscurity,” this of course will not be a long term strategy).

Private Clouds: Hypervisor Weaknesses Exposed

While some hesitancies around public cloud infrastructure may still exist, infrastructure changes resulting from rapid private cloud adoption could result in new risks, the scope of which we may not be fully aware of, yet, organizations will be expected to proactively protect against. For example, in a private cloud scenario, a virtual machine can sit on multiple servers or be accessible through multiple hosting centers. A systems administrator may know the virtual machine is accessible, but it’s difficult to know who has access to it, when it was accessed, or what was done once access was achieved. The hypervisor provides some of that much-needed control, but at the same time becomes an attractive target for attack. In 2012, protecting against hypervisor threats will quickly become an IT security priority, and, as we achieve greater maturity in the virtualization space, we could potentially see the cost efficiencies of virtualization take a second seat behind increased risk. We will also see IT security teams taking a more significant role in the initial build-out and deployment of private clouds to initiate much-needed proactive security infrastructure.

What are your thoughts on these 2012 trends to watch? Do you have some of your own to share?

IT Security Rewind – Week of November 28

Posted on December 5, 2011 by Josh Arrington

Returning from a holiday break is never easy, so if you were slightly neglectful to your industry news this week don’t fret – we’ve got it covered. It may have been a week of turkey hangovers for some of us, but the IT industry was busy reporting end-of-year recaps, forecasts for 2012 and of course, breaking news: Here is our summary of this week’s hottest stories.

Looking to achieve a life of “privilege” as an IT security pro? InformationWeek posted its annual “Best Paying IT Security Jobs In 2012” article and guess what? Security professionals can expect salaries to increase by an average of 4.5% in 2012—not bad in such a tumultuous economy. If you are a security professional in a midlevel/ senior role you are in a great position as demand is high. Supply, however, remains a different matter. Robert Half Technology said it expects to see “an abundance of positions and a shortage of skilled candidates.” As expected, the article also reported demand would soon increase for people who could manage “privileged identity management.”

Cyber crime linked to terrorism – In far more serious news, the FBI has revealed that four hackers were arrested in the Philippines last week in connection with an organized attack on the clients of U.S. telecommunications giant AT&T. Law enforcement officials believe the suspects were employed by the terrorist group Jemaah Islamiyah, which has been linked to numerous bombing attacks. According to Reuters, the FBI claims that AT&T’s customers were the targets of the hackers and were not the carriers themselves. An anonymous source reportedly added that the hackers breached the phone systems of AT&T customers and made calls to expensive international premium-rate services.

Water-pump hack pumped with errors – The SCADA hack that resulted in a water pump being destroyed has proven to be false – Wired reported this week that a contractor who was supposed to work on the system logged in according to permissions during a vacation trip to Russia, which was misconstrued as an outside hack. In truth, the water pump simply burned out, as pumps are wont to do, and a government-funded intelligence center incorrectly linked the failure to an internet connection from a Russian IP address months earlier.

That about wraps it up for this week – we’d love to hear your thoughts on this week’s happenings – leave your comments here…

services.

That about wraps it up for this week – we’d love to hear your thoughts on this week’s happenings – leave your comments here…

IT Security Rewind – Week of November 14, 2011

Posted on November 21, 2011 by Josh Arrington

The Thanksgiving holiday is a great time to reflect on the things we are grateful for in IT security like data protection, fraud prevention, identity management and other preventative approaches. Here’s our look at the biggest stories of the week, where those approaches may have failed. IT teams take note, don’t let these headlines ruin your turkey dinner:

From Russia, with No Love: According to reports from Wired and CNET, hackers from Russia were able to destroy a water pump at a utility in Illinois by hacking into their SCADA system. This is a disturbing attack, as the hackers apparently breached the network of the company that made the SCADA system, stealing customer usernames and passwords. Worse—this appears to be very similar in scope and process to the recent RSA breach, and it also highlights to continued vulnerability of SCADA systems to these types of attacks (and the importance of controlling privileged access points and hardcoded passwords).

No Safe Space: Details are just beginning to form surrounding new of a Romanian hacker accused of hacking into NASA beginning on Dec. 12, 2010. Authorities claim that the hacker was able to obtain unauthorized access to protected data—an indication that abuse of privileges may have occurred. The hacker, who ended up destroying most of the data, was arrested and charged with multiple crimes.

No One Loves the IRS, Especially the GAO: In broader security news, the Government Accountability Office (GAO) has blasted the Internal Revenue Service (IRS) for failing to implement stronger security measures after numerous reports regarding organizational weakness in internal control over information security. The GAO takes particular exception to the IRS “deficiencies in its controls over access to the automated systems and software applications” and other weaknesses that “increase the risk of unauthorized individuals accessing, altering, or abusing proprietary IRS programs and electronic data and taxpayer information.” If the details are true, it’s quite evident that the IRS is not effectively and proactively managing privileged accounts and identities.

That’s our news for this week—let us know what we missed, and what you are, or aren’t thankful for in the realm of IT security!

Cyber-Ark Takes on Vegas: Virtualization Becomes a Reality and Why the Night Shift is Not a Deterrent

Posted on November 10, 2011 by Adam Bosnian

As I walked around the beautiful and magnetic Cosmopolitan hotel in Las Vegas, the venue for our fifth annual North American Customer Event, it was fulfilling to reflect on how far we have come in the past year. Our vision for proactively protecting sensitive assets has taken on a greater sense of urgency and is increasingly becoming important not only from a security and compliance perspective, but also from a business continuity stand point.

Cyber-Ark has continued to grow across all aspects of our business – with consistent quarter-over-quarter revenue growth, a global management team with expanded depth and experience, and the addition of more than 200 new enterprise customers for a total of more than 950 global customers. In addition to several enhanced solutions announced over the past year, we chose this event to unveil the latest version of our Privileged Identity Management Suite, with version 7 featuring first-of-its-kind auto-discovery capabilities for proactively detecting privileged accounts within virtualized environments to support security and compliance priorities across the data center.

Last year, for many customers, managing, monitoring and controlling privileged accounts in virtualized environments was a discussion only in its very nascent stages. Today, those challenges are quickly coming to the forefront as organizations take advantage of the numerous operational and cost benefits associated with virtualized technologies. However, as we highlighted in our new Privileged Identity Management Suite announcement, that adoption also leads to exponential security risk specifically related to the rapid provisioning of new virtual machines, and managing and monitoring related privileged access and activity. Additionally, organizations need to continue to be acutely aware of the risks of attacks targeting hypervisor privileged accounts, given their massive, high-level access to potentially thousands of virtualized servers, databases and applications.

In fact, our keynote presenter, Joji Montelibano, who leads the Insider Threat Technical Solutions and Standards team at CERT, provided a riveting presentation with details on the types of threat cases his team tracks and analyzes – from sabotage and fraud, to IP theft and espionage. In fact, he shared one story detailing a near-catastrophic network meltdown after a poorly performing IT administrator had been demoted to the night shift. Bad move says Joji who shared insight into the “30 day rule” – CERT finds most theft occurs within 30 days of someone leaving their job. Joji also shared advice on steps attendees should take within three months of his presentation, such as establishing an incident handling plan, along with suggestions on how to better manage the insider threat through continuous logging, targeted monitoring and real-time alerting.

We thoroughly enjoyed the spirited and insightful customer discussions during this event, and learning more about how our solutions are being used to address current and emerging security, process and operational pain points across the enterprise. I would also like to extend my gratitude to our spectacular Cyber-Ark team who were instrumental in making this such a memorable event.

And, our team isn’t slowing down! After attending MILCOM, this week, Cyber-Ark hits the road again, traveling to participate at the Gartner Identity & Access Management Summit as well as the Cloud Security Alliance Congress. Please let us know if you plan to attend either of these events and what you hope to gain from your experiences at the shows.

Blended Attacks: The Nasdaq Edition

Posted on October 25, 2011 by Adam Bosnian

Despite spending nearly $1 billion a year defending itself against constant cyber attacks, news broke late last week in an exclusive report from Reuters that “the hackers who infiltrated the Nasdaq’s computer systems last year installed malicious software that allowed them to spy on the directors of publicly held companies.”

According the story, the Nasdaq case, reportedly similar to the attack against RSA earlier this year, is an example of a “blended attack,” where elite hackers infiltrate one target to facilitate access to another. Nasdaq has said that hackers attacked a Web-based software program called Directors Desk, used by corporate boards to share documents and communicate with executives, among other things. By infecting Directors Desk, the hackers were able to access confidential documents and the communications of board directors.

As Jaikumar Vijayan emphasized in his recent article for Computerworld, “Despite Stuxnet, Duqu, control system flaws still overlooked,” most efforts to fix infrastructure threats are wrongly focused. It seems Nasdaq learned the hard way that throwing a large budget at a security issue to build up perimeter walls won’t fix an issue that’s already inside. ”God knows exactly what they have done. The long term impact of such attack is still unknown,” Tom Kellermann, a well-known cyber security expert, told Reuters of the attack.

Cyber-Ark believes that regardless of the attack vector, there must be heightened emphasis on the importance of proactively locking down and isolating sensitive information, and maybe even more critically, the servers, systems and applications where this confidential information resides or is transmitted to or from. Post-fact reaction by its very nature means that the vulnerability has already been leveraged. Only truly proactive, preventative approaches can help organizations guard themselves from these types of ongoing and often persistent attacks.

Additionally, it’s important to examine the concept of enforcing the rule of least privilege for end-users and security administrators – the idea being to provide only that amount of privilege necessary for a given activity. What’s often overlooked is how these accounts can be tampered with to provide unwanted ‘escalation of privileges’ to aid in persistent attacks – as it appears what happened in the Nasdaq case.

In the RSA case, recommendations to customers included enforcing strong password and PIN policies, and watching closely for changes in user privilege levels and access rights using security monitoring technologies such as SIEM, and consider adding more levels of manual approval for those changes. Could these steps have helped Nasdaq? It will be interesting to learn more as this story continues to unfold.

UK ICO unveils latest research findings

Posted on October 24, 2011 by Nick Lowe

The UK’s Information Commissioner’s Office (ICO) has announced the findings of its annual track survey*. The new figures reveal that almost 75 percent of businesses surveyed know that the Data Protection Act requires them to keep personal information secure, an increase of 26 percent on 2010’s findings. However, reflecting a fall in public confidence, less than half of the people surveyed believe that organisations process their data in a fair and proper manner. The survey also found that the number of data breaches in the private sector is rising, with 58 percent more breaches reported to the ICO so far in 2011/2012 than in the same period last year.

The ICO’s research highlights some interesting, albeit unsurprising, trends surrounding data protection today in the UK. Whilst a greater proportion of businesses are aware of the data protection obligations placed on them, the public is less confident than ever of these businesses’ ability to safeguard their information.

Indeed, why should the public have any faith in the existing practices employed by organisations, when news report after news report highlights a series of serious data protection failings? Over the last few months we’ve seen a plethora of NHS Trusts hit the headlines over the loss of substantial and confidential patient information. Throw into that previous reports of the police snooping on citizen’s personal details and it’s not exactly going to do much to bolster public confidence in the state of data protection today.

Whilst we should welcome the fact that the report demonstrates an increase in awareness surrounding data protection, awareness on its own is not going to obliterate this growing problem. What’s needed is action and organisations need to put in place the requisite security tools to ensure that they can properly enforce a sound and water-tight data protection policy going forward.

* http://www.ico.gov.uk/news/latest_news/2011/businesses-waking-up-to-data-protection-responsibilities-21102011.aspx

IT Security Rewind – Week of October 10, 2011

Posted on October 17, 2011 by Josh Arrington

This week we honored Christopher Columbus, someone who undoubtedly took a major risk and in the end, discovered something completely new. Thus it is appropriate that in this week’s IT Security Rewind we must report the passing of the visionary Dennis Ritchie, creator of the C programming language and co-developer of the Unix operating system. eWeek.com provided the following quote from Jeong Kim, president of Alcatel-Lucent Bell Labs, “Dennis was well loved by his colleagues at Alcatel-Lucent Bell Labs, and will be greatly missed. He was truly an inspiration to all of us, not just for his many accomplishments, but because of who he was as a friend, an inventor, and a humble and gracious man. We would like to express our deepest sympathies to the Ritchie family, and to all who have been touched in some way by Dennis.” To read more about Dennis’ accomplishments visit: http://www.eweek.com/c/a/Security/Dennis-Ritchie-Founder-of-Unix-C-Dies-at-70-215748/.

In other security news this week:

FTP may be dying but collaboration is not: eWeek’s Cameron Sturdevant (@csturdevant) took a look at the effect of the consumerization of IT on collaboration tools highlighting some major security vulnerabilities that have arose with the adoption of these free Saas tools. With the proliferation of mobile devices Sturdevant emphasizes the importance of regulations in file sharing stating, “There are reasons to put boundaries on user collaboration, and licensed SaaS and on-premise tools are often best equipped to put these restrictions into practice. Blocking restricted data is among the chief reasons to curtail user file sharing. Helping well-meaning employees stay on the right side of the law when it comes to using regulated data is an important feature that is missing from nearly all the no-cost Internet services.” We completely agree and hope that Sturdevant will check out our secure file transfer solution to see how we successfully secure data in transit.

The real threat is still Inside: Despite constant media chatter around advanced persistent threats and external hackers, Dark Reading reported on a study that serves as a good reminder to organizations to look inside their organizations for threats within company walls. The study, conducted annually by Amplitude Research on behalf of VanDyke Software, found that a “of the many reasons cited for network intrusions, more than half could be attributed to internal issues: lack of adequate security policies (17 percent); employee negligence (12 percent); unauthorized access by current or future employees (11 percent); employee Web usage (6 percent); and lack of software updates (6 percent).” Surprisingly, hacker/network attacks accounted for only 14 percent of intrusions; viruses, malware, and spyware were 10 percent.

PCI still a pain point for many: Okay we admit it, we love reports, especially when they support messages we’ve been sending for some time now. This report conducted by Verizon and covered by SC Magazine UK, found that “most businesses that accept credit or debit cards, or both, continue to struggle to achieve and maintain compliance with the Payment Card Industry Data Security Standard (PCI-DSS).” In fact, of those assessed by Verizon, only 21 percent were found to be fully compliant. These results were almost identical to last year’s which proves that, as an industry, we need to do more to educate organizations and help them to understand how to achieve compliance not just for auditing purposes, but for the protection of their customers’ sensitive information.

NHS loses unencrypted USB stick

Posted on October 4, 2011 by Nick Lowe

Pages ... 1 2 3 4 5 6

IT Security Rewind – Week of January 30, 2012

IT Security Rewind – Week of January 9

Cyber-Ark Predicts: What’s Next on the Privileged Horizon

IT Security Rewind – Week of November 28

IT Security Rewind – Week of November 14, 2011

Cyber-Ark Takes on Vegas: Virtualization Becomes a Reality and Why the Night Shift is Not a Deterrent

Blended Attacks: The Nasdaq Edition

UK ICO unveils latest research findings

IT Security Rewind – Week of October 10, 2011

NHS loses unencrypted USB stick

Recent Posts

“The Compromise of Privileged Accounts was a Crucial Factor in 100% of APTs”: CyberSheath Releases the First APT/Privileged Account Research Report

Worried About Your Next Audit? Advanced Threats? Get to Know Your Privileged Accounts

Protecting Privileged Accounts can be the Difference Between “Managing” and “Securing” File Transfers

Copyright 2013 Cyber-Ark Software - All Rights Reserved