Employees are the biggest threat to network security

“The days when firewalls, data backup and antivirus programs provided sufficient protection are over” according to Corey Steele, network security engineer for local voice and data network solutions provider High Point Networks.

“A network that’s protected just by a firewall, antivirus and backups in this environment is really akin to taking a super carrier from our American Navy today and dropping it into World War II. It would be a similar battle. The threats are so sophisticated that you can’t just protect with those three controls anymore.”

Steele says the No. 1 threat to a company’s network security today is its employees. It’s been his experience that “breaking into a network is much more difficult that breaking into a person.”

“Trust is very deeply ingrained into our psyche. The easiest way for an attacker to get into a network is to break that trust,” he said.

He has found two scenarios particularly successful.

Learn about these two scenario’s, and get the rest of the article from by the Grand Forks Herald by clicking here.

Next-Generation Cybersecurity Is All About Behavior Recognition

Rather than focusing on stopping cybercriminals with walls, new technologies are emerging that work to identify cybercriminals instead. For example, BioCatch technology works to identify patterns of user behavior in certain applications, creating user profiles that can then be matched to subsequent visits. Mimicking a user’s online behavior is far more difficult than breaking down a wall.

Get the whole article here from TechCrunch.com

“I love technology but I’m not in love with technology. The human hunch is priceless.”

A recent survey of government cybersecurity professionals found that 86 percent of respondents believe big data analytics could help improve cybersecurity, but only 28 percent oradare currently fully leveraging big data for security purposes.

Amir Orad built his career at the intersection of cybersecurity and big data analytics. “When I started 15 years ago, very binary, manual security decisions were the norm. We introduced the use of big data for security by adjusting in real-time the level of cybersecurity based on analytical decisions.:

Analytics is key to fighting security information overload, highlighting what’s important, and striking the right balance between automated decisions and decision-making by humans.

Check out the entire article at Forbes.com

Hacker remotely crashes Jeep from 10 miles away

“All they have to do is work out the car’s IP address and know how to break into its systems and they can take control ”

In his disturbing account Greenberg described how the air vents started blasting out cold air and the radio came on full blast when the hack began.

The windscreen wipers turned on with wiper fluid, blurring the glass, and a picture of the two hackers appeared on the car’s digital display to signify they had gained access.

Greenberg said that the hackers then slowed the car to a halt just as he was getting on the highway, causing a tailback behind him – though it got worse after that.

He wrote: ‘The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch.

Get the entire article from http://www.telegraph.co.uk/news

iOS flaw tricks you into giving up your iCloud password

Successful hack attacks often happen not because of tricky coding, but plain old “social engineering” — ie, conning people. The latest version of iOS, 8.3, apparently fails to filter out potentially dangerous HTML code embedded in incoming emails. The researcher’s proof-of-concept code takes advantage of that by calling up a remote HTML form that looks identical to the iCloud log-in window. It could easily trick someone into entering their iCloud username and password, then hide the dialog after the user clicks “OK.”

More from engadget.com by clicking here

Quantum computing is about to overturn cybersecurity’s balance of power

“Spooky action at a distance” is how Albert Einstein described one of the key principles of quantum mechanics: entanglement.  Entanglement occurs when two particles become related such that they can coordinate their properties instantly even across a galaxy. Think of wormholes in space or Star Trek transporters that beam atoms to distant locations. Quantum mechanics posits other spooky things too: particles with a mysterious property called superposition, which allows them to have a value of one and zero at the same time; and particles’ ability to tunnel through barriers as if they were walking through a wall.

We are making substantial progress in harnessing the power of quantum mechanics.

In theory, Quantum computers can perform 2^512 operations simultaneously. That’s more calculations than there are atoms in the universe — by many orders of magnitude.  They will be as transformative for mankind as were the mainframe computers, personal computers, and smartphones that we all use. As do all advancing technologies, they will also create new nightmares. The most worrisome development will be in cryptography. Developing new standards for protecting data won’t be easy.

More on this from the Washington Post by clicking here.


Feds Heighten Scrutiny of TSA Screeners and Aviation Staff to Thwart Insider Threat

Transportation Security Administration and aviation industry employees will be subjected to heightened electronic surveillance following several incidents involving insiders who abused their badges to traffic guns, federal officials announced Monday.

Among the actions that kick in immediately are random passenger-like screening of airline employees throughout the workday and biennial criminal history checks, until there is a system in place for “real-time recurrent” FBI background checks for all aviation workers, officials said.

TSA potentially also might monitor social media communications of individuals near certain airports, as well as suspect employees. And threat assessments of employees could be expanded to include cross-checks of employee information against additional U.S. and international watch lists.

The new and prospective measures stem from an advisory panel report the Department of Homeland Security requested after a former baggage handler last December allegedly helped smuggle loaded guns aboard a Hartsfield-Jackson Atlanta International Airport plane bound for New York City.

The Aviation Security Advisory Committee called for an “immediate pilot” and full operation by the end of 2015.

One potentially divisive recommendation: “When a threat stream is identified, monitoring of social media via keyword GEO Fencing at the appropriate airport, or monitoring of the social media of suspect employees, can be effective tools to determine the existence of an insider threat.”

The committee acknowledged that social media monitoring “can be contentious” if not done appropriately, “but it is vital to today’s security.” DHS was hit with a lawsuit a few years ago for a national security surveillance program that would work, in part, by having the government concoct fake social media usernames and profiles to spy on users.

Other inspection techniques suggested include feeding security camera footage into prediction software that can flag odd activity.

More from NextGov.com by clicking here.

Surveillance strains the ‘backbone of democracy’

Wikimedia and other groups sued the U.S. National Security Agency on Tuesday and challenged one of its mass surveillance programs under the contention that the agency violates Americans’ privacy. In addition, the groups argue that the program would actually have the adverse effect of making individuals worldwide less likely to share sensitive information.

This lawsuit was filed in a Maryland federal court and claims that the NSA is violating U.S. constitutional protections and the law by tapping into high-capacity cables, switches and routers that move Internet traffic through the United States.

The case may become a potential front for privacy advocates who have challenged U.S. spying programs in the past. Privacy because a hotly contested issue in 2013, when documents leaked by former NSA contractor Edward Snowden revealed the long reach of government surveillance.

This particular case, Wikimedia Foundation, et al, v. National Security Agency, attacks “upstream” collection, which happens along high-capacity cables of the Internet and away from individual users. According to the lawsuit, bulk collection violates the constitution’s First Amendment, which protects freedom of speech and association, and the Fourth Amendment, which protects against unreasonable search and seizure.

“By tapping the backbone of the Internet, the NSA is straining the backbone of democracy,” Lila Tretikov, executive director of the Wikimedia Foundation, said in a statement.

More from the State Column by clicking here

Online trust is at the breaking point

IT security professionals around the globe believe the system of trust established by cryptographic keys and digital certificates, as well as the security of trillions of dollars of the 1000 bountyworld’s economy, is at the breaking point.

For the first time, half of the more than 2,300 IT security professionals surveyed by The Ponemon Institute now believe the technology behind the trust their business requires to operate is in jeopardy. 100% of organizations surveyed had responded to multiple attacks on keys and certificates over the last two years.

Research reveals that over the next two years, the risk facing every Global 5000 enterprise from attacks on keys and certificates is at least $53 million USD, an increase of 51 percent from 2013. For four years running, 100 percent of the companies surveyed said they had responded to multiple attacks on keys and certificates, and vulnerabilities have taken their toll.

“The overwhelming theme in this year’s report is that online trust is at the breaking point.

More on this available from Help Net Security by clicking here.

A matter of trust…

Whether it is business or personal, more and more human interaction is happening in an online environment. But, how do you know if you can trust the person on the other end of the connection? The simple answer is most people don’t.

Great article from Florida State 24/7