devyn g's List: Proquest/EBSCOHost

• * Government institutions are successfully attacked  by hackers an average of 84 times a week.

   

  * A total of 44 per cent of UK businesses have  suffered a malicious electronic security incident in the past year. This figure  is almost double the 24 per cent that reported breaches in 2000.

   

  * More than 200 UK companies are now targeted by  hackers every day.

   

  * Eight out of 10 office workers open and read other  people's emails without permission.

   

  'It is incredibly easy to do a search on the internet  for a program that you can then download and use to read emails round your  office,' said Dr Magnus Ranstorp, of the Centre for the Study of Terrorism and  Political Violence, at St Andrews University.

• is
• The
• The good news is that the process industry is  becoming
• The good news is that the process industry is  becoming
• The good news is that the process industry is becoming much more alert to these  issues and that there is now a range of test solutions and products coming out  onto the market. There is also continuing progress with initiatives to develop  security certification and standards in areas such as PLC and DCS vulnerability  testing.
• The good news is that the process industry is becoming much more alert to these  issues and that there is now a range of test solutions and products coming out  onto the market. There is also continuing progress with initiatives to develop  security certification and standards in areas such as PLC and DCS vulnerability  testing.
• The good news is that the process industry is becoming much more alert to these  issues and that there is now a range of test solutions and products coming out  onto the market. There is also continuing progress with initiatives to develop  security certification and standards in areas such as PLC and DCS vulnerability  testing.
• The good news is that the process industry is
• The good news is that the process industry is becoming much more alert to these  issues and that there is now a range of test solutions and products coming out  onto the market. There is also continuing progress with initiatives to develop  security certification and standards in areas such as PLC and DCS vulnerability  testing.
• The good news is that the process industry is  becoming
• The good news is that the process industry is
• The good news is that the process industry is becoming much more alert to these  issues and that there is now a range of test solutions and products coming out  onto the market. There is also continuing progress with initiatives to develop  security certification and standards in areas such as PLC and DCS vulnerability  testing.

•  

  The good news is that the process industry is  becoming much more alert to these issues and that there is now a range of test  solutions and products coming out onto the market. There is also continuing  progress with initiatives to develop security certification and standards in  areas such as PLC and DCS vulnerability testing.
• The good news is that the process industry is becoming much more alert to these  issues and that there is now a range of test solutions and products coming out  onto the market. There is also continuing progress with initiatives to develop  security certification and standards in areas such as PLC and DCS vulnerability  testing
• The good news is that the process industry is  becoming  much more alert to these issues and that there is now a range of test    solutions and products coming out onto the  market. There is also continuing   progress  with initiatives to develop
• The good news is that the process industry is
• Process control networks have been attacked by viruses and worms much more than  most companies are willing to admit, and it's a problem that is going to  intensify
• At the end of 2001 the typical incident profile was 58% accidental, 15% internal  and 27% external. Three months later external attacks suddenly leapt up to  represent 61% of incidents, compared with 32% accidental, 2% internal and 5%  others.

• Evidence of hacker activity in the industrial  environments can also be picked up at Black Hat events - conferences where  hackers, security experts, government officials, network administrators and  others discuss computer security issues. A recent conference in Birmingham, for  example, included a presentation - How safe is a glass of water? - on how to  break into the UK water system.

   

  Hacking, said Byres, "is no longer for fun", with  organised professional criminals carrying out custom-built attacks to extort  money from organisations. Such activities "are today focused on the banking  industry, but moving into our sector" he warned.
• of what's been learned in the IT world but must identif  

   

  y and  address the other 10% that doesn't work on the plant floor, said Byres.    For  example, password systems that lock you out after three invalid entries    might be okay in IT, but not for a
• Industry can use about 90%   

   

  of what's  been learned in the IT world but must identif   

   

   y  and   address the other 10% that doesn't work on the  plant floor, said Byres.     For   example,  password systems that lock you out after three invalid entries      might be okay in IT, but not for  a   mission-critical oil & gas operation.
• y and address the other 10% that doesn't work on the plant floor, said Byres.  For example, password systems that lock you out after three invalid entries  might be okay in IT, but not for a

20 more annotations...

• The  head of the company wants to check on the safety of his customer data .
• The
• The
• The   head
•  

  The
• The  head
• Marc Maiffret used to be a computer hacker. Now  he gets paid to break into the   systems of  Southern California businesses, testing for security weaknesses.
• Marc Maiffret used to be a computer hacker. Now he gets paid to break into the  systems of Southern California businesses, testing for security weaknesses.
• The head of the company wants to check on the safety of his customer data
• The head of the company wants to check on the safety of his customer data
• Just days earlier, a 28-year-old Miami man was charged by federal authorities  with hacking into multiple computer systems and stealing 130 million credit and  debit card numbers -- the largest computer crime ever prosecuted.
• Nearly 10 million Americans were victims of identity theft last year. One recent  study put annual losses related to ID theft at $48 billion.

• "That took just 60 seconds," Maiffret says, grinning.  "And there was nothing abnormal about this client's system. This is how it is in  most cases."

   

  He moves quickly through the dealer's network to  access its customer files.

   

  Maiffret stops on a screen showing that the chief  operating officer of a Fortune 500 company recently paid almost $250,000 for a  sweet new set of wheels.

   

  The screen includes the man's name, address, phone  number, e-mail address, Social Security number, employer and job title -- a  one-stop shop for big-time identity theft.
• "You could sell all that for a lot of money," Maiffret muses. "Maybe $50,000."

• Jason Lidow, founder of the L.A. computer security  firm DigiTrust Group, says most people and businesses have no idea how easy it  is for a cyber-thief to make off with sensitive data.

   

  DigiTrust is the company that unleashes Maiffret on  paying customers.

• Lidow says clients typically pay anywhere from a few  thousand to tens of thousands of dollars for an attack on their system -- in  hopes that this will help protect them from real hackers.

   

  "You can never be 100% safe," Lidow says. "That's not  a message we hide from clients. No one can make you 100% secure.

   

  "The target should be figuring out how you're most  likely to be accessed and then to block that access."

   

  Hackers can plant viruses and malicious software in  people's computers simply by getting you to open a PDF file attached to an  e-mail, or by luring you to a legitimate-looking website where watching a video  might sneak some spyware into your system.

   

  Stan Stahl, head of Citadel Information Group,  another L.A. security firm, says social-networking sites like Facebook and  Twitter also have become hunting grounds for cyber-criminals.

   

  He recalls one case in which a hacker took control of  someone's Facebook page and sent an e-mail to all of that person's friends that  looked like it was from the Facebook member. It said she'd just had her cash and  passport stolen while visiting London -- please wire some money right away.

   

  "And people sent money to the hacker," Stahl says.  "It's a whole new world out there. You don't know who to trust."

   

  There was a time when you couldn't trust Maiffret. He  says he spent much of his teenage years hacking business and government  networks. His come-to-Jesus moment came when he was 17 and the FBI took an  interest in his activities.

   

  "I wasn't arrested," Maiffret says. "But that's when  I understood this wasn't a lifestyle I could keep."

   

  So now he hacks on the side of truth, justice and the  American way -- and a steady paycheck.

   

  After compromising the auto dealer's computer  network, Maiffret sits down with the company's chief marketing officer, whose  expression darkens as Maiffret cycles through screen shots of the various files  he accessed.

14 more annotations...

• The cyber security office will  orchestrate and integrate all cyber security policies  for the government, the president said. It will work closely with the Office of  Management and Budget to ensure agency budgets reflect those priorities, and, in  the event of major cyber  incident or attack, it will coordinate government response.

• "We will ensure that these networks are secure,  trustworthy and resilient," he said. "We will deter, prevent, detect and defend  against attacks, and recover quickly from any  disruptions or damage."
• To ensure that policies keep faith with our fundamental values, this office will  also include an official with a portfolio specifically dedicated to safeguarding  the privacy and civil liberties of the American people," Obama said. "Clear  milestones and performance metrics will measure progress."

• "Given the enormous damage that can be caused by even a  single cyber attack, ad hoc responses will not do,"  Obama said. "Nor is it sufficient to simply strengthen our defenses after  incidents or attacks occur. Just as we do for natural  disasters, we have to have plans and resources in place beforehand, sharing  information, issuing warnings and ensuring a coordinated response."

   

  The problem is spreading. Obama said  cyber criminals launched  attacks worldwide last year that cost consumers $1  trillion.

2 more annotations...