What's New Microsoft decided not to wait for Patch Tuesday to fix the zero-day security hole in every supported version of Internet Explorer that could enable an attacker to deploy malware by a victim visiting a malicious website. Redmond issued an out-of-band patch for the critical vulnerability, which is being subjected to "limited, targeted attacks." Security firm FireEye uncovered the security hole as well as an ongoing attack campaign, which it dubbed "Operation Clandestine Fox." Microsoft said that even Windows XP users will receive an update for the security bug, even though XP is no longer supported. "We have made the decision to issue a security update for Windows XP users. Windows XP is no longer supported by Microsoft, and we continue to encourage customers to migrate to a modern operating system, such as Windows 7 or 8.1. Additionally, customers are encouraged to upgrade to the latest version of Internet Explorer, IE 11," explains Dustin Childs, group manager for response communications at Microsoft Trustworthy Computing. Security researcher Graham Cluley warns XP users not to expect this type of treatment in the future. "If I were you, I wouldn't bank on Microsoft keep coming back to Windows XP. They're only doing this out of the goodness of their hearts," he writes in a blog. Trey Ford, Global Security Strategist at Rapid7, notes that out-of-band security updates are a "big deal ... Corporate and private users should prioritize downloading (testing, where required by change controls) and deploying this patch." For more:
- check out Microsoft's security bulletin
- read Childs' blog
- see Cluley's blog Related Articles:
IE users beware, here comes 'Operation Clandestine Fox'
As Windows XP support deadline approaches, security concerns mount
Spotlight: Firms continue to resist upgrade from Windows XP Read more about: Microsoft, Security Vulnerability
back to top
| This week's sponsor is HP. |   | Reputation Whitepaper
A study by Verizon finds 86% of security breaches come from the outside. Spotting cyber attacks in your network means identifying the signatures of known threats. Reputation data takes that one step farther by identifying communications coming from or going to known bad actors based on their reputations. Read this white paper now for more details. |
The costs associated with data breaches are on the rise, according to an annual report prepared by the Ponemon Institute. In this year's report, the average cost of a single data breach totaled $3.5 million globally, a 15 percent jump from last year. The average cost for each lost or stolen record increased nine percent to $145, up from $136 in 2013. The Ponemon Institute conducted interviews with 1,690 IT, compliance and IT security pros at 314 companies (in 10 countries) that had experienced a data breach, for the IBM-sponsored study. One reason why data breach costs are rising is that a majority of companies have low or no confidence that they are making the right investments in people, processes and technology to address threats. For U.S. firms, the data breach costs are significantly higher than the global average. The average cost per record lost was $201 in 2014, up from $188 in last year's report, which was sponsored by Symantec. Companies surveyed by Ponemon estimate that they deal with an average of 17 malicious codes each month, 12 sustained probes each month and 10 unauthorized access incidents each month. "The goal of this research is to not just help companies understand the types of data breaches that could impact their business, but also the potential costs and how best to allocate resources to the prevention, detection and resolution of such an incident," says Larry Ponemon, chairman and founder of the Ponemon Institute. For more:
- check out IBM's release on the 2014 report
- see the 2013 report (reg. req.) Related Articles:
IT security execs convinced data breach is coming
Security 'game changers' forcing IT security pros to 'do things differently,' says SANS chief
Target breach, Heartbleed bug cause high anxiety among IT security pros Read more about: data breach, IBM
back to top
More than half of utilities say they are not ready for cyberattacks, according to data in an infographic compiled by the Smart Grid Interoperability Panel, or SGIP. The SGIP is a non-profit. public-private partnership established by industry members to improve technical and interoperability standards harmonization to speed the modernization of the energy grid. A full 53 percent of cybersecurity breaches investigated by the Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team from October 2012 to May 2013 occurred in the energy sector, the infographic notes. Utilities cite four main reasons why data breaches occur: misunderstanding of risk, insufficient investment in cybersecurity, lack of cybersecurity awareness and inadequate cybersecurity training. The SGIP offers seven steps for utilities to manage cybersecurity risk better: create prioritized list of business functions based on risk, prioritize processes that support those business fuctions, inventory smart grid systems and assets, identify smart grid system interactions, determine smart grid high-level security requirements, create a plan to prioritize and plug security gas, and monitor smart grid high-level security requirements. To view the full-size infographic, click here. 
Read more about: cybersecurity, DHS
back to top
Cryptocurrencies--used in the past to facilitate the illegal transfer of drugs, guns and anything else you can't find at the corner store--are under investigation by the U.S. government for their potential to fund terrorist plots. A Department of Defense division called the Combating Terrorism Technical Support Office, or CTTSO, is asking third-party vendors to help research the effect virtual currencies could have on terrorist operations. In an advanced planning briefing for industry, the CTTSO explained that, "The introduction of virtual currency will likely shape threat finance by increasing the opaqueness, transactional velocity, and overall efficiencies of terrorist attacks." According to the briefing, some proposed solutions vendors should consider researching case studies from the past 20 years to determine the effect the introduction of cryptocurrencies would have, whether or not it is possible to analyze threat finance models that use cryptocurrency, and how authorities can use information--such as publicly available blockchains--to model and test flows of funds to prevent future attacks. The CTTSO also encourages vendors to research whether countermeasures can be made using the virtual currencies to mitigate terrorist threats. By investigating the potential behaviors of virtual currency within threat networks, the division hopes to recognize patterns and act on them before terrorists have the chance to execute operations. Cryptocurrencies keep identities private, but all transactions are publicly available, a valuable tool when tracking cash flow. While the DoD is exploring the link between virtual currency and terrorism, the Department of the Treasury is downplaying its potential for funding international terrorism. In March, David Cohen, the undersecretary for terrorism and financial intelligence, said during a press conference that virtual currency is of little use to people looking to support terrorist activity. "Terrorists generally need 'real' currency, not virtual currency, to pay their expenses--such as salaries, bribes, weapons, travel, and safe houses," Cohen said. However, Cohen highlighted the use of virtual currency in domestic crimes, and described its effectiveness for bankrolling identity fraud, credit card theft, online scams and malware operations.
For more:
- check out the CTTSO memo
- read a Bloomberg article about Cohen's remarks
- watch the Cohen press conference
Related Articles:
Heartbleed undermines Bitcoin client, developers advise update
Malware empties Bitcoin wallets, denies access to files until ransom is paid
New worm infects thousands of IoT devices, mines cryptocurrency, Symantec warns Read more about: Bitcoin, Department of the Treasury
back to top
In an era of increasingly sophisticated and well-resourced cybercriminals, IT security pros are feeling underfunded and overwhelmed. That is the conclusion of a survey of 4,881 IT and IT security pros in 15 countries conducted by the Ponemon Institute on behalf of security firm Websense. According to the survey, 57 percent of respondents doubt that their firm is protected from advanced cyberattacks and 63 percent don't think they can stop the theft of confidential data. This lack of confidence is reflected in the frequency of successful cyberattacks. A full 44 percent of respondents said their firm was the victim of one or more cyberattacks that infiltrated networks or enterprise systems in the past year. Close to 60 percent of respondents said that their company lacks adequate intelligence about cybercriminal activities or that they are unsure about the effects of attack attempts on their firm. Surprisingly, their companies' leaders do not equate losing confidential data as a potential loss of revenue, despite the devastating effect that large data breaches, such as that at Target, have had on companies. Nearly half of respondents say their board-level executives don't understand IT security issues. In fact, research by the Ponemon Institute and Symantec shows that a data breach costs the average U.S. enterprise $188 per record lost and $5.4 million per incident. A majority of respondents don't believe they have a good understanding of the threats facing their companies. Only slightly more than one-third could say with certainty whether their organization had lost sensitive or confidential data from a cyberattack, and 35 percent of respondents who knew that they had lost sensitive data did not know what the data was that was stolen. For more:
- read the full report (reg. req.)
- check out the Ponemon/Symantec release Related Articles:
IT security execs convinced data breach is coming
Target breach, Heartbleed bug cause high anxiety among IT security pros
Verizon provides insight into attackers' behaviors Read more about: data breach, cybercriminals
back to top
| 
I'm glad the CEO of Target, Gregg Steinhafel, 
No comments:
Post a Comment
Keep a civil tongue.