 August 19th, 2010 by lhaas
Companies need to protect themselves both inside and out. According to a report by Verizon and the Secret Service, summarized in the article below, while external parties still pose the largest threat, 48 percent of security breaches originated from within the organization.
Organized cyber-criminals and malicious insiders were responsible for most corporate data breaches in 2009, and used tactics like credential abuse, hacking and sophisticated social engineering to get away with their heists, according to a new report by Verizon and the Secret Service.
In a first-of-its-kind collaboration, Verizon and the Secret Service confirmed 141 breach cases in 2009 that resulted in 143 million compromised records. With the addition of three years of Secret Service data, Verizon has now documented more than 900 data breaches over the last six years involving 900 million individual records.
“The chance to study a larger set of breaches is certainly something that we enjoyed,” said Wade Baker, director of research intelligence at Verizon Business. ”
Adding the Secret Service data contributed to give us a more accurate picture.
“The additional information revealed a much higher number of inside breaches than previous reports had shown, with 48 percent of breaches originating from inside a business or organization. However, external parties still posed a larger threat, having been involved in 70 percent of all cases 27 percent of the cases studied were plotted by a combination of agents, which accounts for overlaps.
via Study finds more data breaches are inside jobs – SFGate.
viaForensics has developed tools and services to help organizations protect themselves from both internal and external threats. But organizations needs to start taking actions proactively rather than waiting until the breach occurs.
August 19th, 2010 by teull
I’m not saying we’re doing this (legally)… but I’m not saying we’re not.
Passwords with fewer than 12 characters can be quickly brute-force decoded using a PC graphics processing unit (GPU) that costs just a few hundred dollars, according to researchers at the Georgia Institute of Technology.
Article: Passwords Quickly Hacked With PC Graphics Cards – InformationWeek
August 18th, 2010 by teull
This expert takes a look at recent numbers provided by the large tech vendors regarding shipments, and concludes that mobile may have already overtaken desktop OS:
What’s interesting is that, with the explosion of iOS devices and Android over the past year and the relative stagnation of the desktop market, mobile OS shipments are approaching that of desktop OSes. In fact, smartphones may be surpassing desktop OS shipments right now…
Here’s the thing: Smartphones are currently exploding in an unprecedented way, thanks largely to Google’s Android OS. Earlier this quarter, Android devices were selling at half the speed they are currently. That doesn’t mean other platforms are slowing down either. With the exception of Windows Mobile, every other major platform is growing phenomenally.
The Numbers Don’t Lie: Mobile Devices Overtaking PCs
The takeaway: if you are concerned with infosec and/or digital forensics you have to be versed in mobile devices, otherwise you are missing the boat. (A big, big boat.)
August 17th, 2010 by teull
This article comes from a company focused on providing news, training and education in the areas of information security, risk mitigation and fraud. Their source is the Identity Theft Resource Center, a nonprofit that tracks this issue.
There have been 41 data breaches involving financial institutions so far in 2010 – well on the way to surpassing the 62 such incidents in all of 2009.
via bankinfosecurity.com: 41 Banking Breaches So far in 2010
The article also links to an interesting timeline of breaches including type. Even more startling is that many breaches still go unreported, as also reported in the article.
For now, the underreporting of data breaches remains a problem, Foley says. The ITRC is one of several organizations tracking data breaches in the United States. Example: The New York list of data breaches that was made public this spring had more than 200 breaches that had not been reported by any news media, she says. This is a problem not just for the victims of those data breaches, but for other potential victims. “The only thing that underreporting or hiding breaches is doing,” Foley says “is allowing criminals to do the same thing to other businesses without law enforcement becoming aware and investigating them.”
While many organizations leverage forensics after they realize a breach has occurred, they fail to leverage forensic technology proactively to help monitor and protect their systems. viaForensics is a pioneer in applying forensic technology proactively, detecting IOC’s (indicators of compromise) and tracking key forensic information that can be crucial in the investigation of suspected breaches.
I wonder how many more banks and corporations have to become “data breach” headlines before they get serious about security?
August 16th, 2010 by lhaas
We don’t jailbreak iPhones, but this might be important update for those that do.
Owners of the iPhone will be able to legally unlock their devices so they can run software applications that haven’t been approved by Apple Inc., according to new government rules announced Monday.
The decision to allow the practice commonly known as “jailbreaking” is one of a handful of new exemptions from a 1998 federal law that prohibits people from bypassing technical measures that companies put on their products to prevent unauthorized use of copyright-protected material. The Library of Congress, which oversees the Copyright Office, reviews and authorizes exemptions every three years to ensure that the law does not prevent certain non-infringing uses of copyright-protected works.
For iPhone jailbreakers, the new rules effectively legitimize a practice that has been operating in a legal gray area by exempting it from liability. Apple claims that jailbreaking is an unauthorized modification of its software.
via New gov’t rules allow unapproved iPhone apps – Yahoo! News.
August 13th, 2010 by lhaas
This article provides a good summary of how corporations can be targeted by cyber criminals. liveForensics can help address some of these issues.
Is your company’s data under surveillance by foreign spybots looking for any competitive advantages or weaknesses they can exploit? This might sound farfetched, but such electronic espionage is real. It’s an insidious security threat that’s a lot more common than you probably realize.
As an IT or security executive, determining whether your organization is under attack via this seemingly undetectable threat — and putting in place adequate technology and procedural safeguards — should be a high priority. The stakes are too high to ignore the problem.
via The quiet threat: Cyber spies are already in your systems.
August 12th, 2010 by lhaas
Data breaches are costing companies millions each year, according to the studies cited in the following article.
Organizations are getting hit by at least one successful attack per week, and the annualized cost to their bottom lines from the attacks ranged from $1 million to $53 million per year, according to a newly published benchmark study of 45 U.S. organizations hit by data breaches.
The independent Ponemon Institute's “The First Annual Cost of Cyber Crime Study” (PDF), which was sponsored by ArcSight, showed a median cost of $3.8 million for an attack per year, a price tag that includes everything from detection, investigation, containment, and recovery to any post-response operations. “Information theft was still the highest consequence — the type of information [stolen] ranged from a data breach of people's [information] to intellectual property and source code,” says Larry Ponemon, CEO of the Ponemon Institute. “We found that detection and discovery are the most expensive [elements].”
And a separate report called “The Leaking Vault” (PDF) released today by the Digital Forensics Association found that among the 2,807 publicly disclosed data breaches worldwide during the past five years, the cost to the victim firms as well as those whose information was exposed came to whopping $139 billion.
The article goes on to say:
“It seemed that the majority of the 45 organizations were random and haphazard in their approach” to the problem, Ponemon says. “They didn’t have the right tools or technologies, and they didn’t know what kinds of threats there were and that the actual attacks were happening” until afterward. One finding in the report gave a nod to SEIM tools: Organizations with a SIEM solution incurred 24 percent less costs of the breach than those that did not.
This point illustrates the need for organizations to take a more proactive approach to their data security. Tools (such as liveForensics) can help organizations monitor and stay one step ahead of security issues. A small investment up front could save a fortune down the road.
via One Breach = $1 Million To $53 Million In Damages Per Year, Report Says – DarkReading.
August 12th, 2010 by lhaas
Push to talk on android…interesting.
In a few short years, Android has essentially taken over the feature phone market. By hiding most of the difficult features, carriers are able to produce a phone that’s cool, app rich, and familiar.
via Quick look at the Motorola i1 with Push-to-talk.
August 11th, 2010 by lhaas
Our friends at Intrepedus Group had good things to say about our Android Forensics training course. It opened up a discussion on their blog about root access. Share your thoughts with us.
I had the opportunity to take a very interesting Android Forensics course last week offered by ViaForensics. They’ve compiled great research and have developed some excellent tools for Android devices which can be a huge time saver for forensics analysis. However, I had not realized the degree to which the tools and analysis in that space right now are dependent on being able to obtain root access on the device. This reminded me of a side discussion that went on at DefCon 18…
via Mobile Rooting Jailbreaking: Feature vs Privilege Escalation – Intrepidus Group – Insight.
August 10th, 2010 by lhaas
An important ruling that could affect our industry:
A U.S. District Court judge on Tuesday ruled that it’s not a criminal act to violate the Terms of Service of a Web site, a decision hailed by the Electronic Frontier Foundation.
The case, Facebook v. Power Ventures, arose because Power offered software that allowed users to aggregate Facebook friends and other data with similar sets of data from other social networking sites.
Facebook argued that because its Terms of Service forbid users from using automated methods to access user data, Power’s software violated California’s computer crime law, specifically section 502(c).
via Violating Web Site Rules Not A Crime — InformationWeek.
|
|
