USB Attacks Need Physical Access Right? Not Any More

Exploiting USB Driver vulnerabilities

NCC Group Research Director Andy Davis presented 'USB Attacks Need Physical Access Right? Not Any More...' at this year's BlackHat Asia in Singapore.

Due to recent advances in a number of remote technologies, USB attacks can now be launched over a network. The talk went into detail about how these technologies work, the resulting impact on the world of USB bugs and included a live demo remotely triggering a USB kernel bug in Windows 2012 server.

It's an interesting research, refer here to download the paper and learn more about USB Bugs.

Effectively Assessing Information Risks within the Enterprise

3 Lines of Cyberdefence

By combining responsible management, risk management and compliance functions and internal audits, organizations will go far in securing their data and systems. 

To succeed, internal auditors and business systems owners, including chief information security officers, must collaborate more closely to assure the security of their organizations' data systems. 

A new report from PwC, Fortifying Your Defenses: The Role of Internal Audit in Assuring Data Security and Privacy, which identifies three lines of cyberdefense:  

Management: Companies that are good at managing information security risks typically assign responsibility for their security regimes at the highest levels of the organization. Management has ownership, responsibility and accountability for assessing, controlling and mitigating risks. Risk management and 

Compliance Functions: Risk management functions facilitate and monitor the implementation of effective risk management practices by management, and help risk owners in reporting adequate risk-related information up and down the enterprise.

Internal Audit: The internal audit function provides objective assurance to the board and executive management on how effectively the organization assesses and manages its risks, including the manner in which the first and second lines of defense operate.

It's vital that internal audits be at least as strong as the management and risk management and compliance functions for critical risk areas. Without internal audits that provide proficient and objective assurance, organisations risk having their information privacy practices becoming inadequate or outmoded. 

This is a role that internal audit is uniquely positioned to fill, but, it must have the support and the resources to match to do so.

Refer here to download the report.

Managing Operational Risks and Vulnerabilities Created by Increased Connectivity

Industrial Controls System Security White Paper

Connectivity from the Top floor to the Shop floor – it's a common and growing trend with significant benefits and challenges. Watershed cyber security events like Stuxnet, Flame, and Duqu have focused attention on the operational risks and vulnerabilities created by increased connectivity.

Enterprises are striving to meet connectivity needs while minimizing information security risks. Enterprises need cost-effective solutions to address the network management and security challenges that arise from adding connectivity to automation systems and integrating them with Corporate business systems.

The purpose of this paper is to explain where vulnerabilities within a HMI/SCADA system may lie, describe how the inherent security of system designs minimize some risks, outline some proactive steps businesses can take, and highlight several software capabilities that companies can leverage to further enhance their security.

Pls refer here to download the whitepaper (registration maybe required).

Whitepaper: HMI/SCADA System Security Gaps

Understanding and Minimizing Your HMI/SCADA System Security Gaps


Being at the heart of an operation’s data visualization, control and reporting for operational improvements, HMI/SCADA systems have received a great deal of attention, especially due to various cyber threats and other media-fueled vulnerabilities.


The focus on HMI/SCADA security has grown exponentially in the last decade, and as a result, users of HMI/SCADA systems across the globe are increasingly taking steps to protect this key element of their operations. The HMI/SCADA market has been evolving over the last 20 years with functionality, scalability and interoperability at the forefront.


For example, HMI/SCADA software has evolved from being a programming package that enables quick development of an application to visualize data within a programmable logic controller (PLC) to being a development suite of products that delivers powerful 3-D visualizations, intelligent control capabilities, data recording functions, and networkability. With HMI/SCADA systems advancing technologically and implementations becoming increasingly complex, some industry standards have emerged with the goal of improving security. However, part of the challenge is knowing where to start in securing the entire system.


The purpose of this paper is to explain where vulnerabilities within a HMI/SCADA system may lie, describe how the inherent security of system designs minimize some risks, outline some proactive steps businesses can take, and highlight several software capabilities that companies can leverage to further enhance their security.


Refer here to download this website. (Registration Required)

Ernst & Young: Attacking the smart grid

Penetration testing techniques for industrial control systems and advanced metering infrastructure


The industrial control systems that provide automation for critical infrastructure have recently come under increased scrutiny, and the need to protect current infrastructure as well as integrate security into new system design is now a top priority. Penetration testing has become the latest trend in the ICS space; however, the cultural and technological differences between control systems and traditional IT systems have caused confusion around how to perform a penetration test safely and effectively. 


In this briefing, we will discuss the changing landscape in control system architecture, with special attention paid to smart grid infrastructure, and highlight the implications for security. A description of the lifecycle of a penetration test is followed by a breakdown of a typical ICS infrastructure. Specific penetration testing activities are explained for each component to provide insight for control system engineers and management into how penetration testing can benefit their organization.


Refer here to download the whitepaper.

Satellite Communications for SCADA equipment monitoring

Benefits of satellite communications


Benefits of introducing a satellite communication link into SCADA systems include: 

• Ubiquitous service territory closes gaps in terrestrial coverage
• Fast cost-effective deployment with low hardware and installation costs
• More reliable than congested cellular data networks
• Benefits of remote monitoring

Benefits of monitoring and controlling oil & gas and utilities equipment remotely include: 

• Higher operational efficiencies
• Reduced site visits Improved safety
• Increased scalability

About this white paper: 


"Satellite Communications for SCADA Equipment" outlines the benefits of remote monitoring and shows how satellite communications equipment fits into the SCADA monitoring system. It also discusses how to connect to an RTU using satellite messaging terminals and explores cost structure for mass deployment.


Timely information about asset health and behavior, along with software applications that organize data and implement work flows, allows oil and gas companies to save time and streamline processes that previously required arduous paperwork and manually tracked decision-making.

Refer here to download the whitepaper.

Top 10 Reports for Managing Vulnerabilities

Free Security eBook

I would like to recommend a free security eBook "Top 10 Reports for Managing Vulnerabilities". I think it is worth to share with all of you.

This free guide covers the key aspects of the vulnerability management lifecycle and shows you what reports today's best-in-class organizations are using to reduce risks on their network infrastructure.

New network vulnerabilities appear constantly and the ability for IT security professionals to handle new flaws, fix misconfigurations and protect against threats requires constant attention. However, with shrinking budgets and growing responsibilities, time and resources are at constrained.

Therefore, sifting through pages of raw vulnerability information yields few results and makes it impossible to accurately measure your security posture.

This guide cuts through the data overload generated by some vulnerability detection solutions and introduces The Top 10 Reports for Managing Vulnerabilities.

It's limited time offer, PDF Version: http://tinyurl.com/3hx2e3e

5 Strategies to Improve IT Security

Building Security Culture, Monitoring Risk Top Tactics

The Energy Department's Energy Sector Control Systems Working Group, just published a paper, Roadmap to Achieve Energy Delivery System Cybersecurity, aimed at boosting cybersecurity in that industry.

The paper presents five strategies to improve IT security that's appropriate for other sectors, as well. They are:

1. Build a Culture of Security: In a culture of security, extensive dialogue about the meaning of security and the consequences of operating under certain levels of risk is continuing, by various means, among citizens and stakeholders.
   
   When integrated with reliability practices, a culture of security ensures sound risk management practices are periodically reviewed and challenged to confirm that established security controls remain in place and changes in systems or emerging threats do not diminish their effectiveness.
   
   
2. Assess and Monitor Risk: Risk assessment and monitoring give organizations a thorough understanding of their current security posture, enabling them to continually assess evolving cyberthreats and vulnerabilities, their risks, and responses to those risks.
   
   
3. Develop and Implement New Protective Measures to Reduce Risk: New, protective measures are developed and implemented to reduce system risks to an acceptable level as security risks, including vulnerabilities and emerging threats, are identified or anticipated.
   
   These security solutions are built into systems, and appropriate solutions are devised for legacy systems.
   
   
4. Manage Incidents: Managing incidents is a critical strategy because cyberassaults can be sophisticated and dynamic and any system can become vulnerable to emerging threats as absolute security is not possible.
   
   When proactive and protective measures fail to prevent a cyber incident, detection, remediation, recovery and restoration activities minimize the impact of an incident on a system. Post-incident analysis and forensics enable stakeholders to learn from the incident.
   
   
5. Sustain Security Improvements: Sustaining aggressive and proactive systems security improvements over the long term requires a strong and enduring commitment of resources, clear incentives and close collaboration among stakeholders.
   
   Collaboration provides the resources and incentives required for facilitating and increasing sector resilience.

Air traffic system vulnerable to cyber attack

Next-generation global air traffic control system is vulnerable to malicious hacks that could cause catastrophe

An alarm blares in the cockpit mid flight, warning the pilot of an imminent collision. The pilot checks his tracking display, sees an incoming aircraft and sends the plane into a dive. That only takes it into another crowded air lane, however, where it collides with a different plane. Investigators later discover that the pilot was running from a "ghost" - a phantom aircraft created by a hacker intent on wreaking havoc in the skies.

It's a fictional scenario, but US air force analysts warn that it could be played out if hackers exploit security holes in an increasingly common air traffic control technology.

At issue is a technology called Automatic Dependent Surveillance - Broadcast (ADS-B), which the International Civil Aviation Organisation certified for use in 2002. Gradually being deployed worldwide, ADS-B improves upon the radar-based systems that air traffic controllers and pilots rely on to find out the location and velocity of aircraft in their vicinity.

Conventional ground-based radar systems are expensive to run, become less accurate at determining position the further away a plane is, and are slow to calculate an aircraft's speed. Perhaps worst of all, their limited range means they cannot track planes over the ocean.

So instead of bouncing radar signals off aircraft, ADS-B uses GPS signals to continuously broadcast a plane's identity, ground position, altitude and velocity to networks of ground stations and other nearby aircraft. This way, everyone knows where everyone else is.

ADS-B transmits information in unencrypted 112-bit bursts - a measure intended to make the system simple and cheap to implement. It's this that researchers from the US air force's Institute of Technology at Wright-Patterson Air Force Base in Ohio are unhappy with. Donald McCallie, Jonathan Butts and Robert Mills warn that the unencrypted signals could be intercepted and spoofed by hackers, or simply jammed.

The team says the vulnerabilities it has identified "could have disastrous consequences including confusion, aircraft groundings, even plane crashes if exploited by adversaries" (International Journal of Critical Infrastructure Protection, DOI: 10.1016/j.ijcip.2011.06.001).

Vulnerabilities Could Let Hackers Spring Prisoners From Cells

Most people don’t know how a prison or jail is designed, that’s why no one has ever paid attention to it. “How many people know they’re built with the same kind of PLC used in centrifuges?

Vulnerabilities in electronic systems that control prison doors could allow hackers or others to spring prisoners from their jail cells, according to researchers. PLCs are small computers that can be programmed to control any number of things, such as the spinning of rotors, the dispensing of food into packaging on an assembly line or the opening of doors. Two models of PLCs made by the German-conglomerate Siemens were the target of Stuxnet, a sophisticated piece of malware discovered last year that was designed to intercept legitimate commands going to PLCs and replace them with malicious ones.

Stuxnet’s malicious commands are believed to have caused centrifuges in Iran to spin faster and slower than normal to sabotage the country’s uranium enrichment capabilities. Though Siemens PLCs are used in some prisons, they’re a relatively small player in that market. The more significant suppliers of PLCs to prisons are Allen-Bradley, Square D, GE and Mitsubishi. Across the U.S. there are about 117 federal correctional facilities, 1,700 prisons, and more than 3,000 jails. All but the smallest facilities, according to Strauchs, use PLCs to control doors and manage their security systems.

Researchers says the vulnerabilities exist in the basic architecture of the prison PLCs, many of which use Ladder Logic programming and a communications protocol that had no security protections built into it when it was designed years ago. There are also vulnerabilities in the control computers, many of which are Windows-based machines, that monitor and program PLCs.

The vulnerabilities are inherently due to the actual use of the PLC, the one-point-controlling-many. Upon gaining access to the computer that monitors, controls or programs the PLC, you then take control of that PLC. A hacker would need to get his malware onto the control computer either by getting a corrupt insider to install it via an infected USB stick or send it via a phishing attack aimed at a prison staffer, since some control systems are also connected to the internet.

Prison systems have a cascading release function so that in an emergency, such as a fire, when hundreds of prisoners need to be released quickly, the system will cycle through groups of doors at a time to avoid overloading the system by releasing them all at once. Researchers confirms that a hacker could design an attack to over-ride the cascade release to open all of the doors simultaneously and overload the system.

An attacker could also pick and choose specific doors to lock and unlock and suppress alarms in the system that would alert staff when a cell is opened. This would require some knowledge of the alarm system and the instructions required to target specific doors, but researchers explains that the PLC provides feedback to the control system each time it receives a command, such as “kitchen door east opened.” A patient hacker could sit on a control system for a while collecting intelligence like this to map each door and identify which ones to target.

While PLCs themselves need to be better secured to eliminate vulnerabilities inherent in them, prison facilities also need to update and enforce acceptable-use policies on their computers so that workers don’t connect critical systems to the internet or allow removable media, such as USB sticks, to be installed on them.

Refer here to read more about this research.

Ten Rules for Cyber Security

Is these Ten Rules should be addressed in a comprehensive legal approach to cyber security?

Before the Estonian incident, organisations tended to treat their risks and arrangements in isolation. Cyber security was merely the sum of individual contingency plans having little to do with more temic risks.

The spectrum of cyber conflict ranges from breaches of internal policy or regulations (not patching software, for example) to breaches of legal obligations (such as not reporting illegal activity) to crime to national-security threats to outright cyber warfare ("cyber armed attack").

Ten rules focused on issues and working solutions arising from discussions among experts or in the course of cyber-incident handling can be identified:

1. The Territoriality Rule
2. The Responsibility Rule
3. The Cooperation Rule
4. The Self-Defence Rule
5. The Data Protection Rule
6. The Duty of Care Rule
7. The Early Warning Rule
8. The Access to Information Rule
9. The Criminality Rule
10. The Mandate Rule

In this paper, the Author analyses these ten rules that outline key concepts and areas that must be included or addressed in a comprehensive legal approach to cyber security. They are intended to raise awareness about existing legal complications involving cyber security and the ways to overcome them, to serve as a focus for debate and coordination within and across disciplines, and to inform wellgrounded proposals for additional legislation on the international level.

Security concern as cyber threat grows

Australian Government will soon release a white paper focusing on Cyber Security!

The Gillard government has become so concerned about attacks on the computer systems of industry and the public sector it will produce a white paper focusing largely on cyber security.

In a speech in Adelaide today, Attorney-General Robert McClelland will warn that foreign intelligence agencies, criminal gangs and commercial competitors are targeting intellectual property in Australia worth $30 billion.

Mr McClelland will say malicious activity is increasing to a point where computer systems in both the government and the private sector are under continuous threat.

"Cyber espionage is not just the purview of foreign intelligence agencies, but something undertaken by criminal organisations and commercial competitors alike," Mr McClelland says.

And Defence Minister Stephen Smith says attacks on Australia's computer systems are becoming increasingly sophisticated and targeted.

Development of the paper will be led by the Department of Prime Minister and Cabinet and extensive public consultations will begin next month with the release of a discussion paper.

It is expected the white paper will be ready in the first half of next year.

Mr McClelland says the cyber threat to Australia is real, evolving and continuing to test the nation's defences. "It comes from a wide range of sources, and from adversaries possessing a broad range of skills."

The cyber white paper will help Australians to connect to the internet with confidence. The document will provide a comprehensive review of how governments, businesses and individuals can work together to realise the full benefits of cyberspace while ensuring risks can be managed.

"The digital world is evolving rapidly. It's transforming the way governments and businesses operate and the way Australians connect to each other and the world," Mr McClelland says.

Minister for Broadband, Communications and the Digital Economy Stephen Conroy says the white paper recognises the increasingly significant role the online environment plays in the lives of Australians.

"With increased availability and use of technology, it's important that all Australians are able to go online safely and securely," he says.

Source: AustralianIT

Protecting against the Malware and other Security Risks

Latest Information Security Whitepapers

Here are some new security white papers I'd like to share - I hope you find them interesting (registration required).

Embracing Employee-Acquired Smartphones without Compromising Security
http://bit.ly/lRXkS0

Protecting Against the New Wave of Malware
http://bit.ly/k5lMdz

Social Networking and Security Risks
http://bit.ly/lmu7yI

PCI Compliance for Dummies Guide
http://bit.ly/imTwKd

Security Considerations for Small and Medium-Sized Enterprises
http://bit.ly/lugcpb

Top Ten Inside Threats

How to prevent them? - Whitepaper

Insider theft and other malicious behavior are particularly difficult to detect and prevent because employees often have legitimate access to sensitive corporate data and tend to know the weaknesses in their organization's infrastructure. Over the course of hundreds of customer interactions, Prism Microsystems, a leading security information and event management (SIEM) vendor, has developed best practices for monitoring insider abuse.

This whitepaper discusses:

• The top ten insider activities you have to monitor to make sure your employees are not violating security policy or opening up easy routes for insider abuse;
• How implementing these recommendations is fast, cost effective and will help prevent costly insider hacks and data leakage from impacting your business.

Please refer here to download this whitepaper (registration required).

SC Magazine’s recent study of less-shouted-about THREATS

Risks and Rewards of Archiving!

Cloud and social media security are much discussed areas of focus within our profession but what about some of the less shouted-about threats? I thought you might be interested in SC Magazine’s recent study of some of these, which will be discussed in greater detail in 3 of their upcoming webcasts; found at http://www.scwebcasts.tv and http://www.scstudio.tv respectively.

Below is a little more info on the 3 topics to help you assess their relevance to your organisation:

STAMP OUT COSTLY SECURITY DEFECTS IN SOFTWARE DEVELOPMENT
Going live at 2pm GMT, 30th March

The Coverity Scan found an alarming 50,000 defects in just 300 open-source software products. This webcast will give you an instant understanding of the secure coding practices that you should adhere to to eliminate these increasingly costly security vulnerabilities.

Speakers: Robert Seacord, Secure Coding Director, CERT - Software Engineering Institute, Michael White, Technical Director, Coverity

You can secure your free place at: http://www.scwebcasts.tv

ARE RISKY APPLICATIONS UNDERMINING YOUR BUSINESS SECURITY?
Going live at 3pm GMT, 12th April

With 75% of new attacks (CERT) targeting applications and with the lines blurring between personal and business devices, this webcast will shed vital light on the real security repercussions of risky apps in the workplace and what you can do to secure them.

Speakers: Tim Mathias, Director of Security, Thomson Reuters Chris Wysopal, Co-founder & CTO, Veracode

You can secure your free place at: http://www.scwebcasts.tv

THE RISKS AND REWARDS OF ARCHIVING

This webvideo is live now on SC’s site at http://www.scstudio.tv

83% of the 200 IT professionals that SC spoke to (representing both SMEs and larger enterprises) reckoned the cost of email downtime to their business to be over $500,000. This interesting SC Studio show which you can watch right now at http://www.scstudio.tv , offers some interesting pointers on one of the most effective ways to reduce this risk/cost – archiving.

Speakers: Brian Shorten, Risk and Security Manager, Cancer Research UK Giovanni Alberici, Archiving & Continuity Specialist, Symantec.cloud

I hope the shows are relevant to your organisation. As always, do feel free to get in touch with any thoughts on these topics or ideas for future ones.

For the webcasts, if you can’t make the live date of the webcasts you can of course watch them live in the archive at your leisure at http://www.scwebcasts.tv. The studio show you can watch whenever you like at http://www.scstudio.tv .

Sharing some Information Security Resources

Latest Information Security whitepapers

Web 2.0 Security Summit (Webcasts, March 16, 2011 or afterward on demand)

Hear from OWASP, SonicWALL, Accenture, Websense, Aberdeen Group, Fortinet and other security visionaries as they look into the new paradigm of web 2.0 security threats, the issues of privacy, and practical tips on how to prevent large scale data leaks from happening to you.

Register: http://bit.ly/fElMev

Social Networking and Security Risks (White Paper)

The popularity of social networking sites has reached astonishing levels. How protected is your company against risks from these platforms?

Download: http://bit.ly/gmPIDv

The Big Shift to Cloud-based Security (White Paper)

Keeping IT systems secure and running within regulatory compliance mandates seems next to impossible. There are many reasons for this — but fortunately, several recent technological trends show that it doesn't have to be this way.

Download: http://bit.ly/hrUzHV

How to Protect Your Organization against Advanced Persistent Threats (White Paper)

This paper outlines the evolution of APTs, explains the motivation behind them, and determines best practices for defending against these threats.

Download: http://bit.ly/e1HHrv

Security for Google Apps Messaging and Collaboration Products (White Paper)

Read this whitepaper to get a comprehensive look at the security controls, processes and technologies that we have implemented in Google Apps.

Download: http://bit.ly/g6NS4h

Some Lessons to be Learned from Stuxnet

STUXNET creators not so ELITE?

Everyone knows what Stuxnet is and if you don’t you probably missed the most discussed and much praised worm of the past few years.

The worm targeting Siemens systems, controlling critical power infrastructures, has been subject of deep analysis by researchers to uncover who’s behind it and who the final target was. Both of the above questions had readily found an answer: at least according to the authoritative Times, It’s been a joint effort between US and Israel governments, to destroy alleged Iranian projects to build a nuclear arsenal.

Although the goal has not been reached, Iranian path to having nuclear bombs has been set back by 2 years, as President Obama, although skirting the Stuxnet issue, stated in an interview regarding Iran. The much hyped Stuxnet, dubbed as the most sophisticated worm ever, has also been subject of analysis of Tom Parker. Tom is a security researcher who has presented his own analysis and view of the Stuxnet case at BlackHat DC.

For the first time, someone states that Stuxnet worm is not so elite as everybody thought in the beginning and probably media played an important role in the matter. Still according to Parker, too many mistakes (have been) made and too many logic flaws made things go wrong. Parker seconded the hypothesis according to which code was produced by two separate groups: one building the core of it and another, much less experienced, providing the exploits and the command and control code.

Another security expert, Nate Lawson, considers Stuxnet code nothing more elite than any other malware around, not even implementing advanced obfuscation techniques such as anti-debugging routines.

Some more interesting links to learn more details and lesson learnt analysis:
Strategic Lessons of Stuxnet
ICS-CERT Stuxnet Lessons Learnt
Stuxnet Lesson Learned: The Twain Always Meet

Stuxnet - Interesting white paper from Tier-3

Stuxnet: Doomday Bug or Media Hype?

The hot security story of 2010, Stuxnet, the turning point in IT security according to some experts. But was it Y2K-style hype, Doomsday for SCADA systems and ICSs – or a warning for everyone?

This fully-referenced Short White Paper examines:

• The actual threat that Stuxnet poses.
• The parallels between Stuxnet in ICSs and e-espionage in all IT networks.
• How to protect your enterprise against these emerging threats.

I hope you find it useful, to read this paper, please use this link: Stuxnet: Doomday Bug or Media Hype?

Security White Papers

Information Security Resources

Here are some new security white papers I'd like to share with you - I hope you'll enjoy them.

7 Shortcuts to Losing Your Data (and Probably Your Job)

This tongue in cheek white paper explores data loss from a contrarian point of view - exploring the top 7 shortcuts you can take to ensure that you lose your data.

Download PDF: http://bit.ly/hBDpIK

Top Eight Identity & Access Management Challenges with SaaS Applications

This white paper presents the eight biggest identity and access management (IAM) challenges associated with adopting and deploying cloud and SaaS applications, and discusses best practices for addressing each of them.

Download PDF: http://bit.ly/geZi1S

The Silent Danger of Clever Malware

This paper discusses the history and progression of the modern Trojan attack. It explores the methodology used by hackers in selecting a target and developing a compelling attack and cites several examples of some successful targeted Trojans.

Download PDF: http://bit.ly/e4QHCc

Vulnerability Management - Assess, Prioritize, Remediate, Repeat

This report provides insights into Best-in-Class practices for assessing vulnerabilities and threats to IT infrastructure, prioritizing fixes based on the business value of resources and acceptable levels of risk, and remediating through the efficient deployment of patches, configuration changes, and other compensating controls.

Download PDF: http://bit.ly/i35fAH

Increasingly sophisticated threats that target enterprise users and data

Re-inventing Network Security

Enterprise networks and applications have evolved but security infrastructure has not.

Learn why application visibility and control (regardless of port, protocol, or encryption) are critical for preventing increasingly sophisticated threats that target enterprise users and data.

Offered Free by: Palo Alto Networks