devyn g's List: other sources

• Recession and the economic slowdown can make companies susceptible to cyber  attacks as companies have been compromising network security in the name of  cutting costs that can eventually result in disaster.
• These are times when companies have to be more careful about security issues,  says Debashish Naik, Director of Asian School of Cyber Law.
  
• during recession and economic meltdown, a number people are laid off or their  salaries pruned. This can create resentment against the company they are working  for and can indulge in things that are detrimental to the company's interest
• Cyber crime is a big problem worldwide
• "Most IT companies are secured, but their clients may not have similar security.  All companies need foolproof security measures."
  
• Security is often taken for granted. The need to install proper cyber security  is ignored
• 
  Very few companies spend on firewall or proper antivirus softwares. They  don't even hire services of ethical hackers to test loopholes in their security  system.
  
• He added that companies should have security compliance auditor who should  directly report to the CEO of company on the adequate security  existence.
  
  
• The study warned that the recession was proving to be a hotbed for fraudulent  activity as cyber criminals were capitalising on a climate of consumer fear and  anxiety.
• there was a risk that cyber crime would impact consumer confidence, further  hindering the speed of global financial recovery.

8 more annotations...

• Q:   

  If  
•   Q:   How prepared are U.S. companies for a cyber  terrorist attack?

• Q:   

  If there's one  thing you could tell CIOs and CSOs to do, what   would it be?  

  There's no one thing, but one message is that senior management  needs to make
• are inadequately prepared. Too little attention is paid to security, too few  resources are devoted to it
• Q: Has corporate security improved since the attacks of Sep.    11?
• Q: Has corporate security improved since the attacks of Sep.  11?
• more companies have taken needed steps but we're not close to where we need to  be. It's just not where we must be...Certainly, there's more attention to the  issue than two, three, four years ago
• There are more attacks
• The sophistication of those attacks is growing. There are terrorist groups to  deal with. Foreign nation states are using cyber technologies.
• What networks do you think terrorists might target?

• Targets we're likely to see hit by cyber attacks are critical  infrastructures. That's where the impact would be the broadest and most severe.  We've seen Al Qaeda planning to take out dams and power grids. Government  agencies are always a target for hackers, and terrorists wouldn't be any  different. Banks, [financial houses, and traders] are big targets because of the  impact it would have on the economy.

• Q: What should CIOs and network administrators be  doing to protect their systems?
• There has to be perimeter security, security at the application level, anomaly  detection on the network, and attention to personnel security
• There has to be a holistic approach
• because insiders are responsible for so much of the attacks and the damage.

• Q: How should government and industry be working  together?
• companies are the most common victims of attacks
• if private companies don't share information about their attacks...There's still  the thought that companies that have been attacked should keep the information  about it internal, rather than share that information with law enforcement and  government agencies
• If there's one thing you could tell CIOs and CSOs to do, what  would it be?
• security a priority. CEOs and Boards of Directors need to pay attention to  security and make sure resources are devoted to it

18 more annotations...

• The government is struggling to keep pace with the growing number of attacks on  its computer networks, potentially leaving key military and civilian systems  vulnerable to overseas hackers, senior U.S. officials said Tuesday.
• nation's cyber defenses were being challenged like never before by  sophisticated, well-organized efforts to disrupt important systems and steal  classified information.
• "Threats in cyberspace move at the speed of light, and we are literally under  attack every day as our networks are constantly probed and our adversaries seek  to exploit vulnerabilities," Lt. Gen. William Shelton,
• the Defense Department detected 360 million attempts to penetrate its networks  last year, up from six million in 2006.
• The Pentagon recently disclosed that it had spent $100 million in the past six  months repairing damage from cyber attacks.
• but top military and civilian officials believe that most of the hacking  attempts originate in Russia and China, which have been pouring resources into  cyber espionage in recent years. Russian and Chinese officials have denied any  wrongdoing.
• The Wall Street Journal has reported that overseas hackers breached both the  nation's electricity grid and the Pentagon's biggest weapons program, the $300  billion Joint Strike Fighter.
• "I'd like to say that our networks are secure but that would not be correct,"  said Army Lt. Gen
• The Obama administration recently completed a 60-day review of the government's  efforts to protect key public and private networks. The administration is  expected soon to appoint a new White House cybersecurity chief, though the final  deliberations over the report have sparked internal White House turf battles.
• Later this month, the Pentagon will create a new military "cyber command" to  coordinate the defense of Pentagon computer networks and improve U.S. offensive  capabilities in cyberwarfare
• Gregory Wilshusen, the director of information security for the Government  Accountability Office, said most "federal systems are not sufficiently protected  to consistently thwart cyber threats."
• Robert Carey, the Navy's chief information officer, said defense contractors  needed to do more to protect their systems from overseas hackers. He said the  attempts to steal information were "advanced, persistent, sophisticated, always  changing and well-resourced."
• He acknowledged potential obstacles, including the difficulty of giving private  companies access to classified intelligence on specific cyber attacks and  possible corporate reluctance to spend the money necessary to better protect its  networks.
• Many civil-liberties groups and companies are wary about giving the government  broad access to commercial systems and networks

12 more annotations...

• German and American company networks remain inadequately protected against  malicious attacks
• Nine out of ten firms on both sides of the Atlantic rely on simple security  mechanisms such as passwords. Yet only a multilayered security network combining  different measures can be counted on to repel intruders.
• Around 86 percent of German companies and 79 percent of American companies use  antivirus software. 80 percent of companies in both countries additionally  protect their networks using firewalls. More than half of the IT managers  surveyed state that they safeguard data using automatic backups. 70 percent of  German firms apply updates regularly to make sure their security programs are  up-to-date. In the USA this figure is 35 percent. Many companies believe  themselves sufficiently protected as long as they have the latest software.
• Yet  on the whole not enough is being done about IT security   

   

  . Most  companies relax in the belief that they are adequately protected against    cyber-attacks. This is also due to the fact that  IT security in both countries   is often  only escalated to management level whe n attacks on IT systems lead to  considerable damage. Data security is regarded as a technical problem and is  therefore often delegated to the specialist department. While in both countries  the CEO generally sets the IT budget – 62 percent surveyed in Germany and 49  percent surveyed in the USA confirmed this to be the case – it can hardly be  said that there has been an interest for this subject up to now at management  level.
  
• This  is however done by only 34 percent of German and 36 percent of American    companies. According to Mummert Consulting and  InformationWeek around a tenth of   companies on  both sides of the Atlantic have not yet established any security   guidelines.  Almost half of those surveyed do not even know whether or not they    have  been the victim of a cyber-attack.
• Only 40 percent of American companies earmarked more funds for IT security in  2003 than in the previous year. In Germany this applied to just 24 percent of  companies
• IT experts believe that even constantly updated classic virus scanners are  increasingly powerless in the face of new species of computer virus. Only the  addition of a personal firewall for every individual terminal used in  conjunction with an Intrusion Detection System (IDS) – a kind of virtual alarm  device – can repel the majority of attacks.
  
• In the USA 43 percent of companies do nonetheless use IDS, and a good third  have personal or user firewalls. In Germany the figure for IDS is 24 percent,  for personal firewalls 29 percent.
  
• This is however done by only 34 percent of German and 36 percent of American  companies. According to Mummert Consulting and InformationWeek around a tenth of  companies on both sides of the Atlantic have not yet established any security  guidelines. Almost half of those surveyed do not even know whether or not they  have been the victim of a cyber-attack.
• Firms should also review their current security guidelines
• From July to September 2003 alone 823 new cyber-threats appeared – 26 percent  more than in the same period the previous year. Almost half of all attacks on  German and American company networks can be put down to viruses, worms and  trojan horses. New applications such as music exchange sites and electronic  messaging systems (instant messaging) leave the door wide open to ever more  sophisticated web-parasites that leave traditional antivirus programs at the  starting blocks.
  Worms are an especially serious threat to companies’ IT  security. In contrast to viruses, these multiply themselves independently  through the network and can so doing cause vast amounts of damage. The “Blaster”  Internet worm alone caused two million US Dollars worth of damage worldwide in 8  days. The increasing number of private Internet connections has also increased  the danger of what are known as “script kiddies”. “Script kiddies” are for the  most part youngsters who obtain hacker software from the Internet and  arbitrarily unleash it without understanding the consequences.
•  

  In Germany almost 60 percent of companies have already been the victims of  external attacks. Nine out of ten suffered financial loss as a result. In the  USA the number of companies who lost more than 500,000 Dollars as a result of  security breaches rose threefold from the previous year to six percent. 85  percent of viruses, worms and trojan horses begin their destructive work in the  USA before spreading all over the world. External attacks paralyze whole  applications or even networks more often in the USA than in Germany. In this  country data storage is particularly prone to malicious attacks. Around twelve  percent of security breaches lead to damage or loss of data. In the USA the  corresponding statistic is approximately six percent.
  
• They often cannot use applications properly and make avoidable mistakes. More  than a third of those surveyed in both countries complain of staff’s lack of  problem awareness and inadequate training. Plans are afoot to change this: 50  percent of companies in the USA and Germany want to do more basic and follow-on  staff training in future.
• Yet on the whole not enough is being done about IT security
• . Most companies relax in the belief that they are adequately protected against  cyber-attacks. This is also due to the fact that IT security in both countries  is often only escalated to management level whe
• However they very seldom have the necessary decision-making powers. Only twelve  percent of the German and 21 percent of the American companies employ a Chief  Information Officer. The figures for companies with Chief Security Officers are  three and five percent. In most cases therefore there is no responsible  decision-maker concentrating on regular risk assessments or security tests
• The best protection can only be achieved by linking single security measures to  a multilayered security network that keeps gateways, servers and client  terminals from being attacked. Data security is after all still considered  important: On a scale of one to ten those surveyed in both countries gave it an  average score of 7.5.

15 more annotations...