Friday, July 5, 2013

Cyber Security bar & terrace


"Waiter, please!, Waiter!". It is possible that those are the words more said in all terraces & bars around the world. Al least in the half of the planet where it's summer now. The climate invites to go out and order a cold beer, a smoothie, a Coke…

But in the darkest terrace in the depth of the Internet, customers are asking for DDoS attacks, spam, theft of personal data… "Cybercrime-as-a-service" is a reality that is growing and getting increasingly industrialized, according to a report by security company +McAfee.

As a result, the number of companies, services and investments in cyber-security is raising. In today's video, the expert Israeli investor Yoav Tzruya explains why now is a good time to invest in this type of business and technology.

But if you are in charge of security for a company, what you need to know is which solutions and services you should buy to keep the challenges you are facing under control. According to Leonel Navarro, Head of Quality Assurance and Validation of Softek, these challenges are mainly those characteristic of the cloud, the BYOD (Bring Your Own Device) and data analytics.

So what should you ask from the menu that offers the bar & terrace of cyber-security? According to the Country Manager at Stonesoft, Maria Campos, is very convenient to define measurable security controls, with automated monitoring and incident reporting.

Internet is a bar & terrace full of pickpockets. Falling into the trap of a phishing attack is like leaving your wallet on the table as you turn to call the waiter. One in five phishing attacks are targeting directly banks and financial institutions, according to a study by security firm +Kaspersky Lab.

To let Europeans enjoy the benefits of the cyber bar & terrace, the European Union plans to toughen prison sentences for cyber-crimes. Thus, for example, those found guilty of running a botnet of hijacked home computers will face prison sentences of at least three years.

Thursday, July 4, 2013

Never, never, never give up

Give Up

"Never, never, never give up" (former British Prime Minister Winston Churchill). Humans beings have an impressive ability to face adversity by severe they are.

If you are responsible for a company that has suffered a cyber-attack, do not let discouragement overcome you and look for ways to fix it. You will need courage and determination to face the costs half a million euros that are associated on average with these kind of assaults to enterprises. You will need it even if it is an SME and the average payout is a figure much smaller (38,000 euros), according to the Global Survey on corporate IT security - 2013 by International B2B and +Kaspersky Lab.

In case your company is located in Mexico, each passing day is more likely that you will have to face one of these situations, according to the 2013 Threat Report by security company +WebsenseMexico is the first country in Center and South America in number of threats and the ninth in the world. Its 42 million Internet users, the lack of regulation in security, poor preparation of users, the increase of mobile devices and the proximity to the U.S., make it a juicy target.

If you experience a computer attack you can not throw in the towel, but as the saying goes "prevention is better than cure". One of the most important threats to organizations is Distributed Denial of Service (DDoS) attacks. There is a number of different solutions in the security market for this type of offense. In today's video, we have a simulation which shows two DDoS attacks: one to a company that is protected and one to a company that is not.

However sometimes we suffer security risks to our own flesh as a citizen. Sharing a scanned image of your ID on a P2P network by mistake can turn your life into hell. With your data, criminals can impersonate you and put all kind of bills and debts in your name. The story of a girl called Sandra which is told in Spanish TV channel +Cuatro is like that. But she did not give up, she was not willing to give up on her identity.

You might think that you would not commit a blunder like Sandra's one. Nevertheless you may often do check-in to share with your friends where you are going, what you do or what you just bought. Thus they will not steal the identity, but it is possible that cyber-criminals rob your house while you're enjoying a daiquiri on a beach in the Caribe. Therefore +Kaspersky Lab asks users to be cautious when posting their location.

So we should not ever be too trusting. Even if you take certain safety measures they are not always infallible. For example, you have a security solution installed on your company computers and it has some vulnerabilities that could lead to SQL injections, XSS attacks, and disclosure of sensitive information. This has happened with Symantec Security Information Manager as +Symantec itself acknowledges. This failure is fixed in version 4.8.1.

Wednesday, July 3, 2013

Errors that you could pay dearly

The Irish writer Oscar Wilde said "experience is simply the name we give our mistakes". In the world of online security, mistakes are a constant. Cyber-criminals take advantage of them to exploit security gaps or human carelessness. And when those criminals make mistakes security forces will be there to catch them.

We do not know what was the error that allowed a website of videogame company Ubisoft to be hacked. The consequence is that the passwords of their users have been exposed, so they recommend to change them as soon as possible. Fortunately there were not stored any bank details in the affected database. We hope they learn from the experience so that does not happen again.

Android device owners should be careful not to commit the neglect of being infected with "Trojan USB Cleaver". Apparently, when connected to a Windows computer a hacker could steal information like passwords from different browsers, as well as WiFi passwords and data network.

A small mistake in the field of computer security can have serious consequences for an organization. It could give a data breach implying financial damage, reputational damage and/or loss of competitiveness. On the other hand, a denial of service attack could paralyze all the company's activity.

Experience shows us that one of the best methods to prevent loss of sensitive data is the encryption of such information. Therefore, the California Attorney General has proposed to enact a law to ensure that companies operating in that U.S. state encrypt the personal information of its customers. It is estimated that the details of nearly a million and a half of Californians were put at risk in 2012.

Sometimes there are mistakes that can send your buttocks behind barsAndrew Auernheimer knows what that is. His mistake was to create an automated tool to extract the names and email addresses of 114,000 iPad 3G owners from AT&T's servers and to pass them to the online news site Gawker. Now he expects a sentence of 41 months in prison to learn the lesson.

Sometimes, it is convenient to make mistakes intentionally in order to find the ways to fix them. For this reason, honeypots are being used as bait to track attacks on critical infrastructure systems. In this way, we can analyze the hackers' behavior and techniques.

Tuesday, July 2, 2013

80 days around the wolrd threats

"Anything one man can imagine, other men can make real". Written by Jules Verne in his novel "Around the World in Eighty Days". It is an adventure that takes Phileas Fogg to travel around the planet by train, boat or elephant to meet with a bet. Nowadays, cyber-threats can almost instantly expand worldwide and their aim is not as noble as the Phileas' one.

According to the security software company +ESETthe most widespread malware in June does not travel by train nor boat nor even through the Internet but infects devices from removable media. It is the worm Win32/Bundpil. In the ESET's ranking they also explains the features of his nine travel mates.

Other hazards that proliferate around the world are related to virtualization and the cloud. According to the Cisco's Annual Security Report 2013, these risks have to do with the violation of the software that creates and runs virtual machines, with a cheaper and easier infrastructure to conduct criminal activities, and the difficulty companies find on implementing traditional security approaches.

In fact, +Cisco Systems itself has released patches to cover some vulnerabilities in several of its security solutions (Cisco Content Security Management Appliance, Cisco Email Security Appliance, Cisco Web Security Appliance) to prevent undesirable adventurers deciding to go that way on their journey.

There are travelers who do not like to travel alone. This is the case of two malicious programs called Beebone and Vobfus, Microsoft alerts as many antivirus are unable to remove them. Each program will donwload slighter different variations of the other in an attempt to evade antivirus software.

Apparently the United Kingdom is the target of at least 70 monthly shipments of sophisticated espionage attacks. As stated by MI5 and the Government Communications Headquarters (GCHQ), their goal is not only to obtain military or government secrets, but mainly the theft of intellectual property for the benefit of foreign nations.

Currently you can thwart "the bad guys'" plans without leaving the chair. Only with your computer. But can you imagine if you could travel flying like Superman to those places where cybercriminals are programing a lethal malware or you could destroy computer viruses simply with a look? In today's video, security professionals tell us what superpowers they would like to own.

Monday, July 1, 2013

Cyber threats cocktail

"Cocktail: a drink made of a mixture of spirits to which are usually added other ingredients" (Royal Spanish Academy). Mojito, Sex on the Beach, Caipirinha, Long Island Iced Tea, Margarita, Manhattan... all of them are names of cocktails, but they could be a list of viruses in honor of the world of those exotic concoctions. On the Internet there are threats of all colors, flavors, with or without ice, virgin or alcoholic, with a slice of lemon or a cherry…

CóctelOur first today's cocktail has a dose of a the Department of Homeland Security’s ICS-CERT's report, two doses of gas compression stations victims of several cyber-attacks in February and two and a half dose of brute force attacks to access the process control network of these stations.

If the above cocktail is too strong for you, we have more. Take a dose of an alert from the security company McAfee, two doses of an executable called emiratesstatement.exe which is camouflaged in a harmless PDF, and a touch ofmalware infections in the United Arab Emirates, Omar and Bahrein tageting government institutions, network companies, internal CRM systems...

To end our today's cocktail list, we offer you one more. You need to put three doses of Ruby, a half dose of update, and two doses of fixing vulnerabilities that allowed to make man-In-The-Middle and denial of service attacks.

As in other sectors, you can find some academic prepared bartenders and others who demonstrate great professionalism simply relying on his expertise without any degree. Do you need a degree to work fighting the Molotov cocktails that attack computer users, companies and governments across the planet? Lorenzo Martínez publishes an interesting debate about it on Security by Default.

Whether they have a degree or not, these master mixologists of computer securityquestion whether the states (specifically the United States) are prepared to deal with a massive cyber-attack targeting critical systems. In CSO they collect a diverse sample of opinions.

In this sense, Singapore Armed Forces launched a new Cyber Defense Operations Hub in which they bring together many of these professionals who are used to mix all kinds of ingredients to prepare their military networks for a possible cyber-attack.

Videos from 2012 CIGTR's I4S course

At CIGTR's Youtube channel, you can access all videos from Innovation 4 Security CIGTR's Summer Course, held in 2012. Click here to go this channel.