Google Glass Alarms Lawmakers

By now, most of us have heard about Google Glass and its potential capabilities -- benign and otherwise. This week, lawmakers have stepped into the fray. Eight members of Congress have sent a letter to Google asking for information about how Google intends to protect public privacy as well as whether or not Google intends to implement facial recognition software into its new product. The idea of people wandering around with internet-connected cameras in spaces where cameras aren't normally allowed is disturbing to many...myself included.

...but many of us are dealing (or not dealing) with this problem today anyway. Just look at your cell phones.

As security professionals we are faced with the daunting task of minimizing risk within an environment without stifling technology or development. Sadly, the problem remains that technology genuinely outpaces our efforts (and our available funding) to make good risk decisions that enable technology use. As we watch the Google Glass maneuverings play out, we need to ask ourselves how we intend to deal with this and other new personally-owned technologies that will start appearing in our offices. Saying "no" is the easy part of the equation; figuring out how is where we earn our money.

Pentagon Report Accuses China of Cyber Espionage

News flash:  China is targeting American business and government entities for cyber attack in order to gain military and economic advantage...

...oh wait...you knew this?

On Monday in its annual report to congress on China's military capability, the Pentagon appeared to come off the fence regarding cyber attacks by China. “In 2012, numerous computer systems around the world, including those owned by the U.S. government, continued to be targeted for intrusions, some of which appear to be attributable directly to the Chinese government and military,”the 100-page report said.  This marks the first time

This revelation marks a turning point which could be good or bad for our profession.  On the one hand, such an admission now allows the government to discuss the situation openly and formally (versus hinting at the problem with nonspecific acronym-easing phrases such as "advanced persistent threat.")  Decisions can be made regarding policy, spending, and priority around the state-sponsored threat which lurks behind the Great Firewall of China.  

On the other hand, we have all seen the lethargic pace at which government is able to respond legislatively to cyber threats;  the Chinese threat may evolve exponentially if we remain content to await congressional policy action.  More concerning, however, is the potential for the focus on China to obscure other potential threats vectors.  As the recent spate of breach and investigation reports demonstrates, state-sponsored hacking still accounts for only a minority of the incidents out there.  

Paying attention to China is a good thing...but we should not focus here to the exclusion of other threats.

The detailed Pentagon report may be found here.  It's worth a read!

Arrests Made in $45 million ATM Breach

Earlier this week seven people were arrested in the U.S., accused of operating the New York cell of what prosecutors said was a network that carried out thefts at ATMs in 27 countries from Canada to Russia. Law enforcement agencies from more than a dozen nations were involved in the investigation, which was being led by the Secret Service.

After penetrating the processor's computer network, the hackers fraudulently manipulated the balances and withdrawal limits on prepaid debit card accounts. Then, teams of so-called cashers allegedly launched carefully timed attacks that caused millions in criminal losses from more than 4,500 ATMs in about 20 countries.

For more on the arrests and information regarding the attacks, check here.  Enjoy!

Comitatus

Stepping onto my soap box for a bit.  Shocking, I know... :)

I read an interesting -- and disturbing -- story this week about a medical doctor in attending the White House Correspondents Dinner with her husband. 

Dr. Seema Jilani -- a New Orleans-born physician who specializes in international healthcare -- is married to a journalist who was attending the correspondents dinner.  Spouses aren't allowed to attend the actual dinner, but show up for the cocktail hour prior to the festivities.  After the actual dinner began, Dr. Jilani realized that her husband still had their keys.  She tried calling him, but he wasn't answering.  She approached the security guards outside of the dining room, and was refused entry because did not have a ticket.

Not an unreasonable response in the slightest...in fact, it was the appropriate response.  The only problem, though, is that the same security guards who refused Dr. Jilani entry into the secured area were allowing other women into that area without questioning their authorized status.  Further, if the reporting is  accurate, one woman who claimed to have lost their ticket was allowed in and personally escorted into the area by the guards.  As Dr. Jilani objected to the double standard, one of the guards threatened to call the Secret Service...remarking that  "We have to be extra careful with you all after the Boston bombings."

Oh, did I fail to mention that the other women allowed in were Caucasian?

I am posting this reference here  not as a political statement nor a criticism but rather as a reminder to we Warriors of the Light who stand in the gap every single day:  our protect-and-serve mission must be carried out objectively and without bias toward any.  It is hard (in both the real and virtual worlds) to eschew cynicism and bias as we stare into the abyss;  however it is only by winning that battle daily that we honor our charges and our charter.  To do otherwise is to become little better than those whom we stand against.  Those Whom We Serve will hopefully respect us and come to rely upon us.  They should never fear us.  This applies not only when screening individuals for events but also when dealing with the business professional who is asking for what appears to be yet another unreasonable exception to information security policy.

Regardless of why you got into this business, true professionals understand that bias and cynicism are luxuries we cannot afford.  If you are reading this posting, I urge you to gently remind those around you of the importance of rising above such temptations.

Okay...stepping off the soap box.  For now :)  Those interested in Dr. Jilani's article can find it here.

Spotlight on Big Data

Shameless plug time :)

This month's CSO Magazine contains a feature story on big data in which I am quoted.  Nothing earth shattering in the article, but it's a good primer for organizations beginning to grapple with the pros and cons of big data analytics technologies.  You can find a copy of the article here.  Enjoy!

A Last Look Back at the Boston Tragedy

Warning:  this is going to be a bit of a rant.

It has been three weeks since the tragic bombings at the Boston Marathon.  During that time we have wept with those who were injured or who lost loved ones...and rejoiced in the tracking and capture of those responsible for this heinous crime.  

Unfortunately, this period has also been one for recrimination.  Several news outlets and elected officials have resurrected that old saw that we saw back in 9/11:  intelligence failure.  Why didn't we know?  Why didn't we prevent the attack?  Information began to surface about Russia sending alerts to US official regarding the activities of the suspected terrorists;  did we follow up?   Did we do enough?  If not, why not?

I remember the first time I was confronted with the "intelligence failure reflex" in conversation.  Working in security (and having worked in the intelligence arena in past lives),  I used to avoid this conversation because it would be a source of annoyance for me.  Finally, an acquaintance notice my ire and pressed me into commentary.  Here's the scenario I gave them in response...

Say you're an intelligence agent working for our government.  You have credible intel that there's going to be an attack in Arizona (where I live) in the next 90 days.  You know that the folks planning this attack are located somewhere within Arizona State University (the largest university in the nation) in some capacity.  Your job is to gather enough credible intelligence to preempt this attack.  

You have certain tools in your toolbelt:

• We have technologies that will take imagery of certain areas and people, but you need to tell us where to point this technology.  If you give me 24 hours notice, I'll task the resources where you want me to, but it'll take an additional 48 hours after that to analyze the data and render you a report.
• We also have technologies that'll allow you to intercept technical data of multiple types.  We can suck up this data en masse, but we need you to tell us who to focus on and look for.  Again, it'll take us 48 hours to cull through any data we've collected to find the specific targets you give us and render a report.

You are also at a bit of a disadvantage:

• ASU has three large campuses that are geographically disperse.  This doesn't include its online presence and its satellite presence.  We don't know which of these campuses/presences is relevant to your investigation...or even if it's only ONE campus versus multiple ones.
• You're in your late 40's (as am I), so you aren't exactly in the same age demographic as a goodly portion of the student population.  This'll limit your infiltration options as well as your interactions with the student population (nothing like a large almost-50-year-old black man hanging out in the student union to shut down conversation amongst the co-eds :) ).

That's your mission.  Good luck!

Now here's the real kicker:  under similar circumstances -- usually with the hindrances of language and ethnicity -- our intelligence and law enforcement professionals stop terrorist attacks and heinous crimes every single day.  Analysts and agents sort through literally thousands of leads daily and successfully interdict foreign and domestic terrorism daily.  During my time in the service, I was personally involved (in very small part) in preventing at least seven terrorist incidents on foreign soil...and I freely admit that my jobs (and skills) were mundane and unexciting.

Am I saying that the bureaucracy is perfect?  No.  Am I saying that mistakes aren't occasionally made?  Not at all. What I am saying, though, is that our underpaid, overworked, and unappreciated law enforcement and intelligence brethren who stand in the gap against seemingly insurmountable odds deserve more that armchair quarterbacking and the continued perception of incompetence others are attempting to heap upon them.  As security professionals we can relate to this situation every time there is a breach or exposure;  let's take a moment to support our fellow Warriors of the Light in different professions who stand in gap daily

*Deep Breath*  Okay...am done ranting.  If you'd like a more articulate explanation as to why tth tragedy in Boston was not an intelligence failure, give this article a read.  Thanks for listening!

Reporting Season is Here

Ah, springtime.  Flowers are blooming.  Baseball is in full swing.  And -- most importantly -- the major security vendors release their summary reports :)

Last month, Trustwave released its 2013 Global Security Report.  Some of its key findings:

• The retail industry made up the highest percentage of their investigations at 45%
• Mobile malware has increased 400%
• The average time from initial breach to detection was 210 days, more than 35 days longer than 2011.  Most victim organizations (64%) took over 90 days to detect the intrusion.
• "Password1" is still the most common password used by global businesses.  

The Verizon report is also short of good news for us:

• 75% or breaches were untargeted and opportunistic.
• 78% of attacks used tactics which were rated as lowor very low on the VERIS difficulty scale
• 75% of attacks were driven by financial motives
• 19% of attacks were perpetrated by state affiliated actors for the purposes of espionage.

While both reports are worth a read (and if you can attend either company's roadshow briefing it's worth it) as security professionals hopefully these reports will cause us to stop for just a moment and reflect on the state of our infrastructures -- particularly as pertains to basic blocking and tackling.  Of late we have been pulled (in large part by the security industry (versus the profession)) down the path of "If we can only suck in more data" and "if we can only better sort through the data we're sucking in" then we can better protect ourselves against that uber-hacker that is trying to infiltrate our systems.  While there is some truth to this approach, it tends to mask the fact that basic blocking and tackling will still resolve much of what we're seeing out there.  I truly wonder what the breach reports would look like if we:

• Enforced heightened password complexity
• Patched vigorously and rapidly (to include addressing aggregate risk via patching low-level vulnerabilities with regularity)
• Cleaned up roles and access to systems, ensuring a least privilege model; and
• Managed(and monitored) super user accounts and privileges aggressively throughout the environment.

If the reports are to be believed, we'd drive out at least two thirds of the breaches and issues that make up these findings -- leaving us ample time to hunt for the needle in the needlestack :)

Both reports are worth your time...not only as information for your SETA programs but also as a reminder to the enterprise of the importance of making the basics work.  You can find copies of both reports just about anywhere these days, but I've uploaded them onto my file sharing site here.  Enjoy!