What's New Long wait times that may have resulted in patient deaths and poor management at the Department of Veterans Affairs led last week to the resignation of VA Secretary Eric Shinseki. And now, a new report by the VA's Office of the Inspector General says that IT security can be added to the list of the VA's problems. The VA has not fixed 6,000 system security risks identified in previous audits conducted under the Federal Information Security Management Act, according to an audit [pdf] conducted by public accounting firm CliftonLarsonAllen for the VA's Office of Inspector General. The audit identified continuing IT security deficiencies "related to access controls, configuration management controls, continuous monitoring controls, and service continuity practices designed to protect mission-critical systems." The report noted: "Weaknesses in access and configuration management controls resulted from VA not fully implementing security control standards on all servers and network devices. VA also has not effectively implemented procedures to identify and remediate system security vulnerabilities on network devices, database and server platforms, and Web applications VA-wide." CliftonLarsonAllen makes 30 recommendations to improve the VA's information security, most of which were made in previous FISMA audits and have yet to be implemented. Among the recommendations, the accounting firm advises the VA to implement an agency-wide risk management system, beef up its password-policy enforcement, and set up policies for securely accessing data remotely. For more:
- check out the audit [pdf] Related Articles:
A tale of two office suites
Big data project analyzes veteran suicide risks
Most PCs without encryption software at Veterans Affairs Read more about: VA office of inspector general, CliftonLarsonAllen
back to top
| This week's sponsor is HP. |   | IPS MQ
The 2013 Gartner Magic Quadrant for Next-Generation Intrusion Prevention System (NGIPS) has been published and HP TippingPoint is in the Leaders Quadrant for the nine consecutive years. Gartner evaluates vendors in a Magic Quadrant on two main dimensions - completeness of vision and ability to execute on that vision. HP TippingPoint continues its strong leadership on both dimensions, driving its placement as the most visionary. Download the report and learn about HP TippingPoint's strengths. |
Cameron Lacroix, a hacker who hacked into Paris Hilton's cellphone 10 years ago and disclosed racy photos of the socialite, has pleaded guilty to charges that he conducted a recent hacking spree that included breaching law enforcement networks around the country, Ars Technica reports. Lacroix, a resident of New Bedford, Mass., pleaded guilty to two counts of computer intrusion and one count of access device fraud, according to documents filed in a Boston federal court. He faces four years in prison and three years of supervised release. As part of his hacking spree, which began in May 2011, Lacroix hacked into the networks of a local Massachusetts police department and published an email account of the department's chief of police, the report relates. He is also accused of breaching the defense of other law enforcement computer servers hosting sensitive data, including police reports, arrest warrants and sex offender information. The New Bedford hacker also breached the servers at Bristol Community College in order to change his grades and those of two other students by stealing the instructors' login credentials. Back in 2007, then Washington Post reporter (now security blogger) Brian Krebs reported that Lacroix was one of a number of hackers who hacked into Hilton's cell phone and published racy images of the reality T.V. star and socialite. Lacroix, who was a juvenile at the time, plead guilty to the hack and served time in a Massachusetts juvenile detention facility. For more:
- read the Ars Technica article
- see Krebs' report Related Articles:
Hackers in chains: 13 of the biggest US prison sentences for electronic crime
Carder forum participant gets 20-year sentence under RICO act
Hackers scour Windows 7 patches for clues to XP flaws Read more about: Massachusetts Police Department
back to top
Decentralization is an old idea, but its recent inclusion as a key tenet for virtual currencies, such as Bitcoin, has changed the way people think about their businesses. CrowdCurity, which serves many Bitcoin-based clients, has modeled the idea of decentralization and crowdsourcing to create a marketplace that helps find and fix vulnerabilities a company could potentially face on an international scale. The company lets its customers hold its own "public vulnerability reward programs," popularized by firms like Google, Facebook and Microsoft, according to its website. In the past, these types of contests were only affordable to large conglomerates, but CrowdCurity wants to make them available to the average company. The company's clients "are getting a solution that actually mirrors the threat; hackers are global so a business should have a global security testing team," said Esben Friis-Jensen, one of three co-founders of CrowdCurity, to Payments Source. "If you're centralizing the work and making it locally-based, it won't be as efficient and creative; you won't get the coverage you need to solve the security problem." Through its network of white hat hackers, CrowdCurity allows website administrators to harness the collected power of the abuses they face on a daily basis from actual malevolent forces. However, the white hat hackers only point out potential exploits and receive payment if they are verified. The flexibility of Bitcoin allows the company to do business with white hat experts all over the world, and 80 percent of the rewards doled out through CrowdCurity are in cryptocurrency form, according to Payments Source.
For more:
- here's the CrowdCurity website
- here's the Payment Source article
Related Articles:
Mt. Gox 'Willy' accounts artificially inflated bitcoin, gamed markets
Bitcoin mining malware hidden in Google Play apps
Heartbleed underscores need for open source bug bounties Read more about: CrowdCurity, white hat
back to top
Chief information officers at U.K. enterprises are facing similar IT security challenges to their counterparts in the United States. Cybersecurity is upper most in the minds of U.K. CIOs and chief technology officers. In fact, close to half of 100 CIOs and CTOs surveyed by Robert Half Technology say that the number of security incidents detected at their firms has increased over the past year. Respondents to the Robert Half surveyed identified the top ten security threats to their organizations. In order, they are network security, email (phishing and social engineering), viruses and malware, physical security, ecrime and fraud, insider threats, data leakage, competitor threats (industrial espionage), privilege user abuse and social media. Unfortunately, only one-third of respondents are very confident that their IT teams have the skills to manage cybersecurity threats, and a similar percentage says that cybersecurity is not a priority for their senior management. Robert Half has put together an infographic summarizing the results of their U.K. CIO andCTO survey. Click here for the full-size infographic. Related Articles:
CIOs, CISOs have "very little influence" in cyber insurance purchase decisions, says survey
Secure access to data, apps is most pressing IT objective for CIOs at European utilities 
Read more about: CIOs
back to top
Faced with a proliferation of security products on the market, enterprises are increasingly looking for cloud-based, consolidated security products to reduce the time and cost of securing their networks. This is fueling demand for unified threat management products, notes market research firm TechNavio, which predicts that the UTM market will increase at a 16.5 percent compound annual growth rate through 2018. UTM products integrate security technologies such as firewalls, virtual private networks, intrusion detection and prevention systems, anti-malware and antivirus products, IP security, web filtering, anti-spam, application controls, load balancing and data loss prevention. "The consolidation of security technologies such as firewalls, intrusion prevention, and web filtering addresses multiple security attack vectors by cyber criminals. It also means that a single company can be made responsible for all the support and transaction activities relating to network security, thereby streamlining security processes and offering major cost-savings for enterprises," says Faisal Ghaus, vice president of TechNavio. The increasing shift toward cloud-based UTM is making installation and upgrades easier, and reducing costs. In addition, cloud-based products can provide signature independent scanning, explains Ghaus. Major vendors in the UTM market are Check Point, Cisco, Fortinet, Juniper Networks, Dell SonicWALL, Sophos and WatchGuard Technologies. For more:
- check out TechNavio's release Related Articles:
Demand for unified threat management appliances on the rise, says IDC
Cisco, Check Point, Fortinet top growing security appliance market, says IDC
Microsoft leads growing SaaS content security market, says Infonetics Read more about: Security Technologies
back to top
| 
No comments:
Post a Comment
Keep a civil tongue.