White House mulls waving cash at businesses to get them to beef up cybersecurity

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The White House is thinking about basically bribing businesses to get them to patch leaky cybersecurity.

According to Politico, the US government is pondering, specifically, tax breaks, insurance perks and other legal benefits for businesses that do some serious overhaul of their digital defenses.

Politico recently got its hands on a May 21 presentation from the Department of Homeland Security (DHS) that raised the notion of such incentives.

The incentives aren't yet finalized.

They would be designed to entice critical infrastructure players in particular, such as power plants and water systems, to adopt voluntary standards that are now being drafted by government and industry in response to an executive order from President Barack Obama.

The standards will be hammered out by DHS and the National Institute for Standards and Technology (NIST). The bodies will be working with businesses to create a security framework that businesses will, ideally, adopt on their own volition.

Politico pointed out that the financial lures also need to be run through federal agencies, including DHS and the Treasury Department, to determine how tasty the enticements can be, either with or without the help of a Congress that has proved, unfortunately, markedly unhelpful.

The 12-page document from DHS - which Politico refrained from publishing - reportedly mulls not only financial and market benefits, but also legal benefits, including limited lawsuit protection for participating companies.

It's wonderful to hear about incentives like this, particularly if they might spur organizations into getting insurance that could help to protect them from potentially devastating costs of data breaches or other cybersecurity dangers.

As it is, insurance professionals will tell you that many, if not most, businesses mistakenly think that general liability policies will cover them in times of cybersecurity mayhem.

Such policies won't, but there are policies that will, and it's wise to learn about them and know what questions to ask about such policies to make sure an organization is as well-covered as possible.

As Politico reports, experts believe that those organizations that adopt upcoming cybersecurity standards could be well-positioned to get breaks on such insurance, being able to point to the standards as evidence that they're following best practices.

This is the juicy stuff that could greatly help to improve security postures.

As it is, the Homeland Security page about cybersecurity incentives is as dry as a sun-baked bone.

DHS talks about secure software engineering, security breach forensics, better training and the instillation of personal data "ownership" - all worthy, mind you, but all very blah, blah, blah.

Tasty cash, on the other hand? Much more interesting, I'd wager.

Let's hope that the Feds can get something done, with or without the help of Congress.

Follow @LisaVaas

Follow @NakedSecurity

Image of White House and bag of cash courtesy of Shutterstock.

View the original article here

Practical IT: Passwords 101 for businesses

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The human element is often referred to as the weakest link in a secure system. Time and time again studies have demonstrated that we are not good at choosing passwords, nor can we keep them secret.

It’s tempting to give up on passwords entirely. Assuming your users' passwords are always compromised is certainly a sensible starting point. Ensuring that high-value, high-risk assets are protected by more than just a password is no longer just strongly recommended, it’s essential.

Despite this, regular initiatives to shore up password strength are unlikely to be wasted time. Maybe your finance app is well protected but you allow users remote access to a password-protected web-based email portal. If so, don’t underestimate the value of an email account to an attacker. Even a low privileged employee’s account is a great place to learn more about a company and launch a plausible social engineering attack.

Similarly, authenticated staff-only apps are rarely tested as well as the public ones. Once an attacker has a foot in the door, privilege escalation is often trivial. That low-value, password-protected web app could be used as the entry point for a larger, more serious compromise.

The starting point

It isn’t a password policy, nor is it user education. As one of the most visible, user-impacting aspects of information security, passwords are something everyone has an opinion on. The starting point is to don your hard hat, get your facts right and set aside a good chunk of time to handle the inevitable debate. Don’t expect people to thank you either – you’re not going to be very popular for a while.

Hopefully you’ve already got a base password policy for your organisation so it’s probably wise to review it. If you don't have a policy, prepare one.

This is where the contention starts. Understand that commonly-argued points regarding length, complexity, forced changes, etc. do generally have some merit. The tricky part is balancing them.

The balancing act

Sure, enforcing very long passwords will cause people to write them down but allowing 3 letter passwords will clearly make them easily guessable.

Likewise, users hate forced changes but never expiring corporate passwords is a risky approach unless you are very confident they will never be compromised. Be it a phishing attack, a simple mistake (can you honestly say you’ve never typed your password into the wrong window) or an attacker sniffing the network for weak hashes, there are lots of ways for passwords to end up in the wrong hands. For more in this area, Bruce Schneier’s advice is a good read.

Complexity controls (requiring numbers, punctuation, mIxEd cAsE, etc) are another perennial discussion point. They have problems, as famously highlighted on xkcd. Humans are also great at gaming them. I guarantee that given any realistic complexity policy you’ll easily be able to create a weak password which passes. But without complexity controls how do you protect against a trivial dictionary attack? You’ll need to weigh up the risk versus reward for your organisation.

Testing passwords

Although controversial, a solid way of cutting through the debate and assessing which passwords are weak in the real-world is to test them with a controlled attack on the hashes. But make sure you have appropriate authorisation to do this! Performing the test safely and securely can be tricky so it might be a good idea to include it as part of a pentest from a trusted firm. As an added precaution, as soon as the list is generated take steps to keep the cracked password list separate from the associated usernames.

The great thing about this approach is that it will likely use the same common tools and techniques that an actual attacker would employ. Theoretically debating strategies for improving password entropy is one thing but the reality is an attack will likely involve one of a few known tools. If one of those tools, out-the-box, employs a strategy that trivially cracks a password hash then it’s unequivocally and demonstrably weak.

It’s worth noting that given enough time you’ll crack every password, limiting the time spent on an attack ensures you’ll get most value from the result by focusing on worst cases. Telling someone with a password of “A

After conducting this exercise, you’ll likely spot some clear recurring problems with passwords which will really help you with a policy tailored towards your organisation. Every organisation is different so it’s important to do this yourself.

That said, an almost guaranteed finding is that password length is the most important factor. If you enforce one thing, it should be this.

Just as important as the actual policy are the associated guidelines. Include links to sensible strategies like Graham’s, below, and provide some examples of bad passwords based on known user behaviour (obviously anonymously and only after they’ve been changed).

(Enjoy this video? Check out more on the SophosLabs YouTube channel.)

Responsibility is important to highlight in the guidelines. Everyone should understand it’s up to them to make sure they choose a good password. Just because a system allows a password doesn’t mean it’s secure!

This may seem obvious but, particularly on systems with strong complexity controls, a common response to a cracked password is: “How can my password be weak, the computer let me choose it?”!

Armed with clear guidelines and an intelligently deployed policy, you’ll probably want to communicate it to everyone using easily cracked passwords. It’s not the time for naming and shaming so use the BCC field and make sure the email carefully explains the test, which account was tested and the next steps to fix it. Obviously including the cracked password, tempting as it may be, is not a good idea. All this will generate some controversy – great!

Getting people thinking and talking about this stuff is half the battle.

Follow @NakedSecurity

Login screen, password sign and system hacked images courtesy of Shutterstock.

View the original article here

Cybercrooks preying on small businesses

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Small businesses might think they are little enough to escape cybercrooks' attention, but they're increasingly wrong.

Case in point: thieves in May took a mere few hours to vacuum $1.2 million out of the bank account of a mannequin maker and importer, according to the Wall Street Journal.

The cybercrooks used online transactions to fraudulently transfer the money from the bank account of Lifestyle Forms & Displays Inc., a 100-employee company in Brooklyn, NY.

The mannequin maker's problems started when the head of finance couldn't get a routine online payment to a foreign vendor to go through.

Repeated attempts to log into the company's banking site with a secure ID token password only resulted in error messages.

The bank said it wasn't a problem on its end. The three-person IT team at Lifestyle Forms & Displays suspected a virus, even though the anti-virus software was up to date.

By the next morning, after IT had cleaned up the computers, they discovered that the thieves had wired the $1.2 million through nine transactions of about $150,000 each to three major U.S. banks and one Chinese bank, the WSJ reports.

CEO Lloyd Keilson tried to claw that money back.

He was partly successful: within five days, the company's bank, New York-based Signature Bank, managed to recover nearly $800,000 from two recipients of the stolen funds: Wells Fargo and J.P. Morgan Chase.

Keilson didn't have such luck with Bank of America and Agricultural Bank of China, the latter of which the WSJ couldn't even manage to reach for comment.

So Keilson set out to make a nuisance of himself: a productive strategy, it turns out.

He pulled the strings of his network. That got him in touch with the secretary to the CEO of one of the US banks.

Using such tactics, he regained a total of about $1.04 million of the stolen money within 15 days of the robbery.

Keilson told the WSJ that he's now trying to figure out if his company's bank is legally responsible for making up the balance of the funds, which are now unaccounted for.

Signature Bank has denied that the security vulnerability was on its part, however.

If the bank is truly without blame, Mr Keilson can likely kiss those funds goodbye, barring the FBI and/or New York Police's success in tracking it down.

George Tubin, a senior security strategist for Trusteer Inc., a provider of cybercrime prevention technology, told the WSJ that courts don't often hold banks liable in cybercrime cases that involve security breaches of their customers' computers:

It comes down to what type of security a bank has in place to detect fraud and what the small business did for the hackers to be able to access its accounts. … As long as the bank provides commercially reasonable security, then the bank's not liable.

The WSJ reports that the theft is indicative of a growing trend wherein criminals are increasingly targeting small businesses.

That trend can be seen in figures from Verizon Communications, which found that about 72% of 855 data breaches analyzed in its 2012 Data Breach Investigations Report [PDF] were at companies with 100 or fewer employees, up from 63% of 761 data breaches analyzed in 2010.

Since the theft, Keilson has instituted a few important safeguards to protect Lifestyle Forms & Displays: 1) no more outbound bank transactions without verbal clearance from an authorized company executive, and 2) a $1 million insurance policy that costs $13,000 a year and will cover losses from cyber fraud.

Good moves. Not many businesses, small or large, have realized what a good deal cybercrime damage insurance currently is.

At the SOURCE:Boston security conference in the spring, Jake Kouns, director of cyber security and technology risks underwriting for Markel Corporation, noted that most companies assume their general liability or professional liability insurance will cover them in the case of cyber attack.

They, most likely, don't.

Sony, for one, found that out following its huge PlayStation Network breach.

Sony's insurer, Zurich American Insurance Co., contested any obligation to cover costs related to lawsuits filed over the breach, arguing that its policy only covered claims for bodily injury, property damage, or personal and advertising injury.

So, is $13,000 a lot for an insurance policy?

Think of the potential costs of a data breach:

Lawsuits, including fines and penaltiesTransmission of malicious code to other networksLoss of the use of your networkCost to notify affected individuals Credit monitoring for customersIdentity restoration servicesSecurity consultantsLegal noticesRestoration of system and dataExtra expenses to remain functional, including new hardware and/or servicesPayment of extortion demandsLost time, lost monies, lost businessLiability from defamatory content maliciously posted on your site, intensified by the search potential of the internet

That list is just for starters.

Is $13,000/year a lot to cover such costs?

Mr Keilson evidently thinks not. Perhaps other small businesses - and large ones too, for that matter - should follow his lead.

Follow @LisaVaas

Cyber criminal photo and cartoon courtesy of Shutterstock.

Lloyd Keilson image: Sarah E. Needleman/The Wall Street Journal.

View the original article here

Hackers attack Norway's oil, gas and defence businesses - BBC News

18 November 2011 Last updated at 06:24 ET Contracts, industrial drawings and logins were all stolen in the attacks Oil, gas and defence firms in Norway have been hit by a series of sophisticated hack attacks.

Industrial secrets and information about contract negotiations had been stolen, said Norway's National Security Agency (NSM).

It said 10 firms, and perhaps many more, had been targeted in the biggest wave of attacks to hit the country.

Norway is the latest in a growing list of nations that have lost secrets and intellectual property to cyber thieves.

The attackers won access to corporate networks using customised emails with viruses attached which did not trigger anti-malware detection systems.

Targeted attacks

The NSM said the email messages had been sent to specific named individuals in the target firms and had been carefully crafted to look like they had come from legitimate sources.

Many of the virus-laden emails were sent while the companies were in the middle of negotiations over big contracts.

It said user names, passwords, industrial drawings, contracts and documents had been stolen and taken out of the country.

The NSM believes the attacks are the work of one group, based on its analysis of the methods used to target individuals, code inside the viruses and how the data was extracted.

The agency said it was publishing information about the attacks to serve as a warning and to encourage other targeted firms to come forward.

"This is the first time Norway has revealed extensive and wide computer espionage attacks," the NSM said in a statement.

Singled out

It said it found out about the attacks when "vigilant users" told internal IT security staff, who then informed the agency.

However, the NSM said, it was likely that many of the companies that had been hit did not know that hackers had penetrated their systems and stolen documents.

Security firms report that many other nations and industrial sectors have been targeted by data thieves in recent months.

The chemical industry, hi-tech firms and utilities appear to have been singled out.

View the original article here