Corporate IT security

  • CybersecurityCybersecurity firms hire former military, intelligence cyber experts

    Over the past two years, U.S. cybersecurity firms have brought in several former military and intelligence community computer experts to help combat hackers targeting the U.S. private sector. For the new private sector employees, the wages are higher and opportunities are endless. Hundreds of ex-government cybersecurity workers represent the competitive advantage of a cybersecurity services industry expected to bring in more than $48 billion in revenue next year, up 41 percent from 2012. “The people coming out of the military and the intelligence community are really, really good,” says a cyber startup founder. “They know the attackers. They know how they work.”

  • Data protectionDo you know where your data is?

    Bitglass, a data protection company, undertook an experiment aiming to gain better understanding of what happens to sensitive data once it has been stolen. In the experiment, stolen data traveled the globe, landing in five different continents and twenty-two countries within two weeks. Overall, the data was viewed more than 1,000 times and downloaded forty-seven times; some activity had connections to crime syndicates in Nigeria and Russia. “This experiment demonstrates the liquidity of breached data, underscoring the importance of discovering data breaches early,” said Nat Kausik, Bitglass CEO.

  • CybersecurityAir-gapped computer systems can be hacked by using heat: Researchers

    Computers and networks are air-gapped – that is, kept approximately fifteen inches (40 cm) apart — when they need to be kept highly secure and isolated from unsecured networks, such as the public Internet or an unsecured local area network. Typically, air-gapped computers are used in financial transactions, mission critical tasks, or military applications. Israeli researchers have discovered a new method, called BitWhisper, to breach air-gapped computer systems. The new method enables covert, two-way communications between adjacent, unconnected PC computers using heat – meaning that hackers to hack information from inside an air-gapped network, as well as transmit commands to it.

  • CybersecurityIT security spending grows, but confidence in cyber protection measures does not

    A new report looking at how organizations view the future of cyberthreats and these organizations’ current defenses, found that while IT spending is increasing, confidence in the efficacy of cyber protection is declining. In a survey of more than 800 IT security leaders and professionals, the report found that more than 70 percent of respondents’ networks had been breached in 2014 — a 62 percent increase from 2013. Security concerns are only going to increase as the number of Internet connected devices increase from fourteen billion today to fifty billion by 2020.

  • CybersecuritySenate panel passes revised cybersecurity bill, but privacy concerns remain

    Last Thursday, the Senate Intelligence Committeepassed the Cybersecurity Information Sharing Act(CISA) meant to encourage the private sector to share data with federal agencies, with the hopes of preventing and responding to cyberthreats before they materialized. The bill is a reincarnation of the 2013 Cyber Intelligence Sharing and Protection Act(CISPA), which drew a veto threat from President Barack Obama because of privacy concerns. Critics say that CISA, as was the case with its predecessor, would create a legal framework for companies to more closely monitor internet users and share that data with government agencies.

  • PrivacyThe Brandeis program: Harnessing technology to ensure online privacy

    In a seminal 1890 article in the Harvard Law Review, Louis Brandeis developed the concept of the “right to privacy.” DARPA the other day announced the Brandeis program – a project aiming to research and develop tools for online privacy, one of the most vexing problems facing the connected world as devices and data proliferate beyond a capacity to be managed responsibly.

  • CybersecurityCyber researchers need to predict, not merely respond to, cyberattacks: U.S. intelligence

    The Office of the Director of National Intelligence wants cybersecurity researchers to predict cyberattacks rather than just respond to them, according to the agency’s Intelligence Advanced Research Projects Activity (IARPA) program. Current cyber defense methods such as signature-based detection “haven’t adequately enabled cybersecurity practitioners to get ahead of these threats,” said Robert Rahmer, who leads IARPA’s Cyber-attack Automated Unconventional Sensor Environment (CAUSE) program. “So this has led to an industry that’s really invested heavily in analyzing the effects or symptoms of cyberattacks instead of analyzing [and] mitigating the cause.”

  • CybersecurityBio-inspired analysis helps in recognizing, characterizing evolving cyberthreats

    Our reliance on cyber systems permeates virtually every aspect of national infrastructure. The volume of network traffic data generated has outpaced our ability effectively analyze it fast enough to prevent many forms of network-based attacks. In most cases new forms of attacks cannot be detected with current methods. The MLSTONES methodology leverages technologies and methods from biology and DNA research — LINEBACkER applies the MLSTONES methodology to the problem of discovering malicious sequences of traffic in computer networks. LINEBACkER allows cyber security analysts quickly to discover and analyze behaviors of interest in network traffic to enhance situational awareness, enable timely responses, and facilitate rapid forensic and attribution analysis.

  • Aviation securityAviation industry under-prepared to deal with cyber risk: Expert

    The aviation industry is behind the curve in terms of its response and readiness to the insidious threat posed by cyber criminality whether from criminals, terrorists, nation states, or hackers, according to Peter Armstrong, head of Cyber Strategy for Willis Group Holdings, the global risk adviser, insurance and reinsurance broker. Armstrong explained that the aviation industry’s under-preparedness is noteworthy in a sector that abhors uncertainty and works tirelessly to eradicate it.

  • CybersecurityTexas lawmakers on the Hill lead drive for cybersecurity legislation

    After recent high-profile cyberattacks on the U.S. private sector, Congress has been tasked with passing legislation that will address cybersecurity concerns including how the private sector should report data breaches to regulators and how the U.S. government should respond to state-sponsored cyberattacks. Three Texas Republican lawmakers, through leadership roles in committees and subcommittees, have been charged with exploring solutions to those concerns.

  • CybercrimeDHS to lead anti-cybercrime campaign

    DHS is gearing up to be the leader in the White House’s campaign to stop cybercrime. President Barack Obama has called cyberspace the “wild west” and that citizens as well as the private sector are looking to the government to be the sheriff. Obama has signed an executive order to promote information sharing between the private and public sector, but many tech companies are hesitant to provide the government cyberthreat information.Under DHS’s proposal, both private companies and government agencies will submit details of previous or current cyberattacks into a shared database hosted by DHS’s National Cybersecurity and Communications Integration Center. Participating entities will then be able to tap into that database to learn about potential attacks targeted at their respective industries.

  • CybersecurityObama’s cybersecurity initiative: a start but businesses – and individuals – need to do more

    By Frank J Cilluffo and Sharon L Cardash

    The linchpin of President Obama’s recently launched cybersecurity initiative is to encourage the private sector to share information to better defend against cyberattacks. Yet U.S. companies have historically been wary of openly talking about their cybersecurity efforts with competitors and with government — for good reason. Many businesses fear that sharing threat-related information could expose them to liability and litigation, undermine shareholder or consumer confidence, or introduce the potential for leaks of proprietary information. For some companies, Edward Snowden’s revelations of sweeping government surveillance programs have reinforced the impulse to hold corporate cards close to the vest. Yet on the heels of a deluge of high-profile cyberattacks and breaches against numerous U.S. companies, we may finally have reached a tipping point, where potential harm to reputation and revenue now outweighs the downside of disclosure from a corporate perspective. Obama’s executive order is thus a spur to get the ball rolling but, frankly, there is a limit to what government alone can (and should) do in this area. Changes in attitudes and behaviors are needed across the board, right down to families and individuals.

  • Cybersecurity businessDHS S&T announces licensing of cyber security technology

    The other day, the Department of Homeland Security (DHS) Science and Technology Directorate (S&T) announced that technology from its Cyber Security Division Transition to Practice (TTP) program has been licensed for market commercialization. This is S&T’s second technology that has successfully gone through the program to the commercial market. The technology, Hyperion, developed by Oak Ridge National Laboratory, is a malware forensics detection and software assurance technology which has been licensed to R&K Cyber Solutions LLC, a Manassas, Virginia-based application development and cyber solution company.

  • CybersecurityData breaches notwithstanding, many companies still blasé about cybersecurity

    Cybersecurity industry analysts predicted that the 2014 data breaches which plagued Target, Home Depot, and JPMorgan – to name but a few — would elevate information security to “top priority concern” among corporate executives. This has not been the case, as recent surveys of chief information security officers (CISOs) and technology executives at the world’s largest companies show mixed attitudes at best.

  • Infrastructure protectionU.S. contemplates responses to a cyber-Pearl Harbor attack on critical infrastructure

    Cybersecurity experts often contemplate how U.S. security agencies would react to a cyber-9/11 or a digital Pearl Harbor, in which a computer attack would unplug the power grid, disable communications lines, empty bank accounts, and result in loss of life. “Ultimately, it absolutely could happen,” says one expert. “Yeah, that thought keeps me up at night, in terms of what portion of our critical infrastructure could be really brought to its knees.”