WISH YOU A HAPPY AND SECURE YEAR 2009
It was like riding a tiger, not knowing how to get off without being eaten – Ramlinga Raju (Asatyam)
While the law will take its course, this incident is particularly unfortunate as the Indian IT-BPO industry had set very high standards of ethics and corporate governance. - NASSCOM
(Congratulations. We are sure that these standards are not only set but also properly documented, implemented and verifiable/certifiable)
Tempest
Tempest originated with the U.S. military in the 1960s as the name of a classified study of the security of telecommunications devices that emit electromagnetic radiation (EMR). Every electronic, electro-optical or electromechanical device gives off some type of electromagnetic signals, whether or not the device was designed to be a transmitter. This is why the use of cellular phones is not permitted on airplanes - their unintentional signals can interfere with navigational equipment. The EMR that "leaks" from devices can be intercepted and, using the proper equipment, reconstructed on a different device. The U.S. government began studying this phenomenon in order to prevent breaches in military security, but today the term has made its way into popular culture because of the proliferation of pervasive computing.
The EMR that is emitted by devices contains the information that the device is displaying or storing or transmitting. With equipment designed to intercept and reconstruct the data, it is possible to steal information from unsuspecting users by capturing the EMR signals. For example, in theory someone sitting in a van outside a person's house can read the EMR that is emanating from the user's laptop computer inside the house and reconstruct the information from the user's monitor on a different device. Different devices have different levels of susceptibility to Tempest radiation, and more and more devices are being created that shield the EMR from leaking from the device. The distance at which emanations can be monitored depends on whether or not there are conductive media such as power lines, water pipes or even metal cabinets in the area that will carry the signals further away from the original source.
While the name Tempest was the code name for the military operations in the 1960s, at a later stage the word became an acronym for Telecommunications Electronics Material Protected from Emanating Spurious Transmissions and an abbreviation of Transient Electromagnetic Pulse Emanation Standard.
By Mark Ward
Technology correspondent, BBC News
2009/01/06
http://news.bbc.co.uk/go/pr/fr/-/2/hi/technology/7807999.stm
To most people the USB stick is a humble, innocuous device that does nothing more than help them tote around their most important files.
But to the US Department of Defense (DoD), the USB stick has a dark side - one that criminally-minded hackers are only too eager to exploit.
In late November, the US DoD imposed a temporary ban on the use of flash drives and other removable, recordable media such as CDs, DVDs and floppy disks. The ban applied to users of both the classified and unclassified networks the US military operates.
The order was sent out to help the security staff at the DoD combat the spread of a Windows worm - a self-propagating program. In this case the malicious program was a variant of the SillyFDC worm known as Agent.btz.
This lurks unseen on USB drives and only springs to life when an infected flash drive is inserted into an uninfected PC.
Once installed, the worm does not sit dormant. Instead, it downloads code from elsewhere on the net and stays in touch with its creators.
To scupper the chance that criminals could be using its network resources, the DoD slapped a ban on the use of USB sticks.
But, said Tim Ellsmore, chief executive of security firm 3ami, those restrictions could make it harder for people to get their jobs done.
"A USB drive is an important business tool for a lot of people," he said. The fact that they were cheap, portable and spacious helped an increasingly mobile workforce cope, he said.
But, he added, flash drives did represent a management headache for many companies.
Mr Ellsmore said 3ami regularly helped organisations that have tens of thousands of users who use many hundreds of flash drives every day.
Rogue devices
Few companies had any idea what was being done with those drives or any other removable media, he said.
Research by Israeli security firm Insightix showed that organisations can have large numbers of "rogue" devices joining their networks every day.
The network auditing firm said that, on average, 20% of the devices connecting to a large organisation's network could be classed as "rogue".
"Not all of the unknown devices will be bad," said Mr Arkin, "but if someone did plug one of these devices in you may not be aware of it and that could be a problem."
Unless organisations know who is connecting to their network and what they are using, said Mr Arkin, managing what they are doing is impossible.
"Knowledge is the foundation of good security," said Mr Arkin.
Chris Boyd, head of forensics at Detica, said the roominess of USB drives made them dangerous devices to leave unwatched.
"The reality is that you can easily buy a very high capacity drive that will hold an awful lot of intellectual property or government secrets," he said.
But, he acknowledged, finding the right policy for USB use was tricky. Get it wrong, he warned, and users could resist.
"If a security protocol is a hindrance rather than a help then users will try to avoid it," he said.
Despite this, he said, organisations had to get to grips with managing their networks and what people were doing on them - if only to protect themselves from unwarranted leaks.
"On a well-managed network that's policed properly, it's very difficult for members of team A to access team B's data," he said.
At the least, he said, data on USB drives should be encrypted so that if it does go astray there is not much that can be done with it.
For 3ami's Tim Ellsmore, an active policy of watching what users do on a network is the only answer.
Users, he said, should be reminded of their responsibilities and the efforts companies were making to keep data secure.
"Until you reach the stage where you can see what people in the organisation are doing, you do not have a clue," he said.
"And if you do not have a clue then how do you go about stopping bad behaviour or promoting good?"
'If I Were a Financial Institution, I'd be Nervous' : Researcher
Linda McGlasson, Managing Editor
January 7, 2009
Reported data breaches increased by nearly half in 2008, and 12 percent of the total hacks were at financial institutions - up from 7 percent in 2007.
This is the news from the Identity Theft Resource Center's (ITRC) 2008 breach report, which shows that 2008's 656 reported breaches were up 47 percent over 2007's total of 446. Seventy-eight of the breaches were at financial services companies. And the ITRC says breaches will continue expanding until more companies start taking data protection seriously.
The two most prevalent types of methods used to remove data from financial services companies are external hacking and insiders, according to Jay Foley, Executive Director at ITRC. "The most recent CSI report shows that 70 percent of hacking has been from the inside, meaning a trusted insider did it," Foley says. "If I were a financial institution, I'd be nervous."
Other data-loss methods tracked include data on the move, accidental exposure and subcontractors.
The ITRC monitors reports from five groups: business, education, government/military, health/medical and financial/credit. Over the three years the ITRC has compiled this report, the financial, banking and credit industries have remained the most proactive groups in terms of data protection.
Report Card for Banking Institutions
But despite having the best record among the five groups, financial institutions still suffer a great deal of loss. Missing laptops and backup tapes stand out as some of the more glaring areas for data loss. In looking at the entire number of breaches, only 2.4 percent of all breaches had encryption or other strong protection methods in use, and only 8.5 percent of reported breaches had minimal password protection.
"That leaves the rest that were unprotected," Foley notes. "Encryption is an extremely positive tool." If one bank encrypts its information, and the bank next door doesn't, he asks, "Where do you think the hacker will go to get data?" An additional point Foley makes is that most backup tapes or cartridges must be read on equipment that is expensive and not easily attainable to the average hacker. "If I was a bank and one of my non-encrypted backup tapes went missing, I wouldn't worry too much. An unencrypted laptop goes missing, that's a whole different matter," he says.
Foley recommends making the rewards for using encryption higher than penalties for not using it. One type of reward would be if encrypted data is stolen, an institution would not have to report it except to law enforcement and regulators. "The fact is, encryption is incredibly strong, and unless a hacker is spending a great deal of time and effort to break it, it won't be breached," he adds, cautioning that no data can be 100 percent protected.
Reputations at Risk
The financial services industry is doing three times better than businesses in protecting data, says Foley, though the industry is not immune to the trends that continue to pervade the other four groups.
Foley sees the tides are turning, with laws such as the FACTA ID Theft Red Flags rule, and companies will begin to face lawsuits because of improper data protection. "In the coming years we're going to see more and more lawyers stepping up to say 'Company X, you didn't have proper procedures in place to protect customer data,'" he predicts.
The other side pressuring change will be the consumers who have heard "for the last eight to 10 years that they need to protect their personal information. Most consumers' data is spread everywhere from the doctor's office to a mortgage loan application to an application for utility service. "A consumer at best only controls 15 percent of their personal information," Foley says. "Companies and other entities hold the other 85 percent." These companies and financial institutions need to be ready to answer the hard questions from John Q. Public when they ask "How are you protecting my data?"
Recommendations
Based on the breach reports from the past 3 years, the ITRC strongly advises all agencies and companies to:
v Minimize personnel with access to personal identifying information;
v Require all mobile data storage devices that contain identifying information to encrypt sensitive data;
v Limit the number of people who may take information out of the workplace, and set into policy safe procedures for storage and transport;
v When sending data or back-up records from one location to another, encrypt all data before it leaves the sender and create secure methods for storage of the information, whether electronic or paper;
v Properly destroy all paper documents prior to disposal. If they are in a storage unit that is relinquished, ensure that all documents are removed;
v Verify that your server and/or any PC with sensitive information are secure at all times. In addition to physical security, you must update anti-virus, spyware and malware software at least once a week and allow your software to update as necessary in between regular maintenance dates;
v Train employees on safe information handling until it becomes second nature.
Leo King
Computerworld UK
January 8, 2009
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9125378
Internet telephone services pose a serious threat to Britain's security, the head of MI5 said.
The danger with online calls, said spy chief Jonathan Evans, was that they do not result in telephone bills, which are key evidence documents in prosecutions. This meant it would be much easier for terrorists to make the calls and eventually escape prosecution if they are tried for criminal offenses.
In an interview with the media Wednesday, Evans, director general at MI5 since 2007, said online phone calls posed a "significant detriment to national security" by enabling terrorists to communicate with less risk.
Evans lent his support to the government's planned database of every phone call, Internet use and e-mail in the U.K., saying that it was important the security agencies could access this information.
"If we are to maintain our capability, we are going to have to make decisions [on powers to intercept communications] in the next few years," he was reported as saying in the Daily Telegraph. "Because traditional ways are unlikely to work."
He was speaking to a small audience of newspaper journalists on the centenary of MI5's creation. It was the first time in MI5's history that a serving head of MI5 had interviewed with the press.
Evans underscored that Israel's attack on Gaza could inspire further extremism and warned that the economic fallout from the global credit crunch may bring fresh security risks.
But critics contend that allowing the government to create such a "super database" raises privacy concerns as well as potential security problems over how the data would be stored.
It emerged in recent weeks that the government has been looking for a private firm to run the database.
CAREER : A Career in Jihad, Interested?
By Shashank Shekhar, Anshuman G Dutta
2009-01-08
Delhi: Terrorist organisations are hiring Pakistani computer professionals to target Indian websites both government and corporate.
It is not just the big IT companies who are looking for tech-savvy youth in Pakistan. The terrorist organisations are equally interested.
Advertisements are regularly put up to attract young professionals for making a career in Jihad. Once recruited, the young minds undergo rigorous training to specifically target Indian websites both government and corporate to steal critical data, said a senior intelligence official.
"All terror groups have hired IT professionals, who are highly qualified to launch e-attacks and sabotage websites. It can not be denied that they are nurturing a new breed of cyber experts for targeting the Indian virtual space," the official added.
Attacks on Indian cyberspace from Pakistani hacker communities have increased in intensity and frequency.
"Pakistani websites feature vacancies for hackers who are capable to attack Indian websites. Considering the number and intensity of Pakistani attacks it can be ascertained that they are well-funded but we are not sure about who is behind it,"
It is learnt that students from Pakistan and Middle East are all set to launch a major attack on Indian websites.
"Lashkar-e-Hackers, which is also known as LeH, is an active group which only attacks Indian websites. They have already attacked many Indian sites and they are expected to get more aggressive,"
Such hackers leave messages for Indian hackers daring them to retaliate. PCA (Pakistan Cyber Army), KSA, Pakbugs Z-company and Zombie_ksa(pakbugscrew) are some of the most active hacker groups in Pakistan.
The cyber war between the hacker communities of the two countries is nothing new. It peaked between 1997 and 2002. From the Pakistani side, the war was led by Pakistan Hackers Club (PHC) and Gforce. These two groups were responsible for defacing hundreds of Indian websites during that period.
