Cyber Attacks

Over the past week, several websites belonging to some of the largest banks in the country have been hacked in what experts are calling one of the "biggest cyber attacks they've ever seen." As this CNN Money article points out, the websites "have all suffered day-long slowdowns and been sporadically unreachable for many customers."

According to security experts, the "denial of service" attacks, which began on Sept. 19, are the largest ever recorded. 

For all businesses, denial of service attacks are a growing and more menacing threat.  Your customers can’t access your website and can’t buy your goods and services. This can be catastrophic to your company. So the question remains: What have you done to protect your business? 

The CNN Money article can be read in its entirety clicking on the link below. 

CNN Money - "Major banks hit with biggest cyberattacks in history"

read more

From the Associated Press, as reported by Time.com.

 

“A sensitive conference call between FBI and British police’s cybercrime investigators was recorded by the very people they were trying to catch, officials and hackers said Friday.

 

Hacking collective Anonymous published a roughly 15-minute-long recording of a conference call apparently devoted to tracking and prosecuting members of the loosely-knit group.

 

The FBI said the information “was intended for law enforcement officers only and was illegally obtained.”

 

“A criminal investigation is under way to identify and hold accountable those responsible,” the bureau said in a statement.

 

It’s not clear how the hackers got their hands on the recording, which appears to have been edited to bleep out the names of some of the suspects being discussed.”

***

Are your phone calls secure?  What about your email?  Clearly, this story shows that all communications are vulnerable and that precautions should be taken.

What precautions are you taking?

You can read the entire AP/Time article here.

read more

Shawn Henry, the FBI's executive assistant director and top cyber official recently stated in an interview that despite the growing prevalence of cyber crime against companies, most business owners and executives don't think that it will happen to their company.  Henry went on to tell of a company that went out of business after $5 million was looted from its bank accounts and of another business that had over decades worth of research and development valued at over $1 billion stolen, "virtually overnight".

 

Henry stated that most hackers fit into three broad categories, "namely nation states targeting research and development, intellectual property and corporate strategies of American companies, terrorists who have shown a growing interest in using cyber attacks against critical infrastructure, and organized criminals wielding botnets (or networks of zombie computers) to attack corporate computer networks."

 

Cyber crime is here and is rapidly growing. What have you done to protect your company? 

 

You can read more about the interview with Assistant Director Henry here.

 

 

read more

FastCompany.com is reporting that the biometric data of almost every Israeli citizen has been compromised and is now available on the Internet. According to FastCompany.com:

 

"Authorities in the Middle Eastern country announced the arrest on Monday of a suspect responsible for the massive data theft. He's a contract worker at the Israeli Welfare Ministry who was allegedly engaged in small-scale white collar crimes after-hours and who is accused of stealing Israel's primary national biometric database in 2006. He had access to the database, which is part of the country's population registry, through his office."

 

The FastCompany.com article went on to say that "[T]he stolen database contained the name, date of birth, national identification number, and family members of 9 million Israelis, living and dead. More alarmingly, the database contained information on the birth parents of hundreds of thousands of adopted Israelis--including children--and detailed health information on individual citizens."

 

Clearly, as more governments, such as India and Germany, collect more biometric data on their citizens, the security of such information will continue to be an issue.  For corporate America, this breach underscores the need to keep security at the forefront as you collect and use more and more personal information for customers and employees.

 

You can read the FastCompany.com article by clicking here.

read more

As the eighth annual National Cyber Security Awareness month winds down, a new survey highlights the dangerous disconnect between perception and reality among small business owners about their cyber security efforts. The survey, sponsored by Symantec and the National Cyber Security Alliance, found that more than 80 percent of small business owners believed they were safe from cyber attacks, yet relatively few took steps to eliminate the risks of such attacks by, for example, formalizing an internet security policy or preparing a contingency plan in the event of a data breach. 

 

Perhaps more troubling, the survey demonstrated that the ill-preparedness of small businesses is not due to a lack of awareness of such risks, or an underestimation of the harm cyber attacks pose to their day-to-day operations. Indeed, two-thirds of the surveyed companies say their company is dependent on the Internet, and many of the companies indicated they deal with sensitive information such as financial records, private customer data and intellectual property. 

 

Because the media often focuses its attention on the large, sophisticated cyber attacks that disrupt large corporations and result in massive data and privacy breaches, it is easy for small businesses to believe that they are simply not an attractive target for cyber thieves. Yet in many respects smaller businesses represent the “low hanging fruit” for such attacks, since they still deal with sensitive and valuable information. Moreover, given their smaller size, small businesses may stand to lose more from cyber attacks.

 

Given the ease with which cyber attacks can be launched, and the increased frequency of such attacks, small business owners would do well to re-evaluate their efforts to keep their data safe and secure.

read more

Reuters is reporting that the United States Securities and Exchange Commission has formally asked public companies to disclose cyber attacks against them.  This is the first such request by the SEC to public companies.  The SEC issued guidelines on last Thursday that set forth the new information that all public companies should disclose. This request follows a series of high profile cyber attacks and other internet crimes.

 

According to the Reuters article, the SEC has asked for very specific information including “examples of estimates that may be affected by cyber incidents includ[ing] estimates of warranty liability, allowances for product returns, capitalized software costs, inventory, litigation and deferred revenue.” 

 

Clearly, cyber security is becoming a high profile item as evidenced by this recent requirement by the SEC.  All companies, both public and private, should evaluate their cyber security protocols and procedures and adjust them as necessary to deal with the increasing threats.  You can read the rest of the Reuters article here:

 

http://newsandinsight.thomsonreuters.com/Legal/News/2011/10_-_October/SEC_asks_companies_to_disclose_cyber_attacks/

read more

According to a recent article in Wired Magazine, “Two separate hacker groups whose activities are already known to authorities were behind the serious breach of RSA Security earlier this year and were likely working at the behest of a government, according to new statements from the company’s president.”

The article goes on to state that due to the sophisticated nature of the breach, RSA believes that a nation-state had to be behind the attack. Clearly, the question then becomes “which nation-state”?

I think the takeaway for businesses should be that attacks and the actors are getting more sophisticated in their actions. As such, the security of data, systems and operations should become one of a company’s top IT priorities.

You can read the Wired Magazine article here:
http://www.wired.com/threatlevel/2011/10/two-hacker-groups-breached-rsa/  

read more

As companies become more and more dependent on new technologies such as cloud computing and tablets to run their businesses, cyber espionage is increasingly becoming an issue, albeit an oftentimes overlooked issue.

A very nice article in the most recent issue of Foreign Policy online illustrates the growing threats faced by companies that connect their systems and operations via the internet. Essentially, the article underscores the thought that foreign companies and governments are increasingly using espionage as a way to compete and as a way to conduct “research and development."

The article states that for corporate America, the cyber war is already here. What are your defenses?

You can read the article here: http://www.foreignpolicy.com/articles/2011/09/06/the_calm_before_the_storm?page=0,0  
read more

According to a recent article that appeared on the “Krebs on Security” bog, a Florida-based financial institution recently fell victim to a $13 million heist, perpetrated by an international cybercrime gang. The cybercriminals in question used ATMs located around the world to cash out stolen pre-paid debit cards.

This crime is proof that cyber security and cyber crime are becoming increasingly sophisticated endeavors. As cyber criminals get smarter, cyber security professionals must work diligently to stay one step ahead of the game.

The entire “Krebs on Security” article can be accessed at the following location: http://krebsonsecurity.com/2011/08/coordinated-atm-heist-nets-thieves-13m/

read more

This from SC Magazine:

 

"The Canadian intelligence service has singled out cyber attacks as one of the biggest threats facing Canada in its latest annual report.

 

The Canadian Security Intelligence Service (CSIS), which is responsible for investigating threats to national security, said that politically motivated threats, or attacks against critical information infrastructure, are of particular interest to it.

 

Foreign states, extremists, criminals and politically motivated individuals top the organisation's list of bad actors that could use Canada's competing infrastructure against it.

 

Energy, finance and telecommunications are particularly vulnerable, according to the agency." 

 

Clearly, cyber threats are increasingly appearing on the radar of both governments and private companies.

 

Have they appeared on your company's radar yet?

 

You can read the rest of the article here and can read the CSIS Report here.

read more