Search This Blog

Friday, December 19, 2008

Security Management Weekly - December 19, 2008

header

  Learn more! ->   sm professional  

December 19, 2008
 
 
CORPORATE SECURITY  
  1. " Text-Message Tipsters Help NFL Tackle Fan Misconduct"
  2. " U.N. Authorizes Land, Air Attacks on Somali Pirates"
  3. " Indian Businesses Push for Security"
  4. " Will Biometrics Measure Up to the Future?" Biometrics Catching on in Europe, Adoption Lagging in U.S.
  5. " The Piracy Problem" Pirates Becoming More Daring, Secure Waters CEO Corey Ranslem Says

HOMELAND SECURITY  
  6. " US Report: Blackwater Could Lose Iraq License"
  7. " A Traumatized Mumbai Seeks to Protect Itself" Mumbai Residents Increasingly Turning to Private Security and Emergency Services for Protection
  8. " Bush Prepares Crisis Briefings to Aid Obama"
  9. " India Will Set Up Federal Agency to Combat Terrorism"
  10. " Scope of Obama's Secret Service Protection Proves Daunting"

CYBER SECURITY  
  11. " Yahoo Limits Retention of Personal Data"
  12. " Microsoft Issues Patch to Fix IE"
  13. " New Top-Level Domain Plan Dangerous, Too Costly, Critics Tell ICANN"
  14. " Modern Society Faces Growing Cyber-Terror Threat"
  15. " Cisco: Cyberattacks Growing, Looking More Legit"


   






 

"Text-Message Tipsters Help NFL Tackle Fan Misconduct"
USA Today (12/19/08) P. 1A ; McCarthy, Michael

Many of the National Football League's 32 teams have implemented a new text-messaging system that allows fans to report disruptive conduct to security. Although fans can still complain to an usher in person, the text messaging system allows fans to alert security without missing any of the game or getting physically involved in a conflict. Teams are asking fans to help identify disruptive behavior as part of a league-wide initiative to crackdown on fan misconduct. NFL Commissioner Roger Goodell announced a new fan conduct code prior to this season due to concerns that drunk, obscene, and violent behavior was discouraging some fans from attending games. Fans who use foul language, make obscene gestures, or harass other fans can be kicked out without refunds and season ticket holders can lose their right to buy tickets for future games. Fans have sent over 1,000 text messages so far this season, with a few sending security photos of disruptive fans using a camera phone. While many fans appreciate the crackdown on disruptive behavior, some angry ticket holders have dubbed the text messaging system "The Rat Line." They argue that the league is ruining the atmosphere of attending a game in person. There are also concerns that fans will be the target of prank text messages and ejected from games even though they are innocent. League officials said that although they do receive some prank messages, all fans are innocent until proven guilty and the overwhelming majority of messages are from fans who are being harassed.
(go to web site)

"U.N. Authorizes Land, Air Attacks on Somali Pirates"
Washington Post (12/17/08) P. A14 ; Lynch, Colum

The United Nations Security Council voted Tuesday to allow countries to perform military raids on land and by air against pirates terrorizing the waters off of Somalia's coast. The American-drafted resolution permits countries to "use all necessary measures that are appropriate in Somalia" in pursuit of pirates, who have interfered with commerce in the Gulf of Aden--which is one of the world's busiest sea routes--and obtained tens of millions of dollars in ransom. However, the raids will only be permitted if they have the approval of Somalia's transitional federal government. The resolution also asks U.N. member states to send naval vessels and military aircraft to conduct the operations, and proposes the establishment of a regional office to coordinate the worldwide effort. Secretary of State Condoleezza Rice stated that the U.S. would help create a contact group of governments to share data and to manage naval and military operations in the region. Rice also asked the shipping industry to fortify the defenses of commercial vessels and urged nations victimized by piracy to hold captured pirates and try them in their own courts. Over 60 ships have been boarded by pirates in 2008, including two on Dec. 16.
(go to web site)

"Indian Businesses Push for Security"
Washington Post (12/17/08) ; Lakshmi, Rama

Leaders from India's largest technology, software, and biotechnology companies are working with government officials to increase security in an effort to reassure investors and ensure that the Indian economy remains on track. For instance, Biocon and several other business technology companies are working with authorities in Karnataka state to develop a security force for the industrial sector in Bangalore. In addition, the Federation of Indian Chambers of Commerce and Industry in New Delhi recently offered to pay a special tax if the government did not have funds to fight terrorism. Representatives from the tourism industry have also proposed creating a special security force made up of former military personnel to provide additional security at potential terrorist targets like monuments and train stations. However, it appears that the efforts may be too little, too late. India's economy, which had been growing at a 9 percent rate for the past several years, is expected to grow by just 6 percent this year, a seven-year low. Meanwhile, India's largest travel Web site, MakeMyTrip.com, reports that it has lost 25 percent of its foreign bookings since the Mumbai attacks. In addition, the Indian tourism industry has fallen more than 2 percent for the first time since 2002.
(go to web site)

"Will Biometrics Measure Up to the Future?"
CNN (12/13/08) ; Fong, Cherise

Biometric security applications have failed to take hold in the U.S., but European organizations are starting to use the technology. Germany's IT-Werke has deployed a fingerprint payment system in 120 Edeka outlets, and in June launched a six-month pilot of a similar system in conjunction with the Equens payment processor in the Dutch supermarket chain Albert Heijn. Footprints, palm prints, veins in hands or fingers, face recognition, iris scans, retina scans, hand geometry, facial thermograms, and body odor are other physiological biometrics that serve as the basis for ID systems. Other biometric ID systems focus on behavior, such as voice prints, signature or handwriting dynamics, keystroke dynamics, and gait. "Commercial products are still primarily limited to fingerprint ID technologies applied to door locks and PCs/laptops," says Hanseok Ko, director of Korea University's Intelligent Signal Processing Laboratory. Motorola is currently marketing its Mobile AFIS device, which can record both fingerprints and facial images, link to wireless networks to upload data, integrate bar code scanners, a smart card reader/writer, GPS, and phone, and can be held in the palm of a hand. It is easier to forge credit card signatures than to commit biometrical ID theft, but it is possible for thieves to illegally access and duplicate archived prints and use them to generate artificial models. "Public acceptance of biometrics has been slow to grow, and will continue to be an issue until issues of privacy and security of data have been brought up to a level acceptable by the majority of people," says Biometrics Institute general manager Isabelle Moeller.
(go to web site)

"The Piracy Problem"
SecurityInfoWatch.com (12/09/08)

A recent series of high-profile hijackings in the Gulf of Aden have drawn the media's attention to the issue of piracy. According to Secure Waters CEO Corey Ranslem, pirates are becoming more violent and attempting to hold ships and crew members ransom for millions of dollars. Although there have always been random attacks in the Gulf of Aden, the recent hijackings of a Ukrainian ship and Saudi oil tanker have fueled speculation that an international network of pirates are specifically targeting ships carrying valuable cargo. Pirates are becoming more daring, attacking ships further off the coast, because they know that crews are usually unarmed and do not pose a threat. Secure Waters does not advocated arming crews but advises ships to travel through the gulf at night because it is harder for pirates to identify and board vessels in the dark. Fire hoses and other non-lethal technology, such as a device that emits an incapacitating sound pulse, can also be used. However, some slow-moving ships might require armed security teams because they are such attractive targets to pirates. An early-detection system and additional surveillance could give ships enough times to raise their speed and evade the pirates. Ranslem said that he anticipates a rise in piracy in other areas of the world, such as Haiti, due to the success of the pirates in the Gulf of Aden.
(go to web site)

"US Report: Blackwater Could Lose Iraq License"
Voice of America News (12/18/08)

The private security firm Blackwater Worldwide faces the "real possibility" that Iraqi authorities may not re-issue the company's license to protect U.S. diplomats in Iraq next year, according to a report by the State Department's inspector general. The report noted that Blackwater may lose its license because Iraqi authorities are upset about violent incidents involving the firm's contractors, including a September 2007 shooting in Baghdad in which at least 14 Iraqi civilians were killed and 20 were wounded. Five Blackwater contractors have been charged for their involvement in the incident. Attorneys for the contractors, who recently surrendered to federal authorities in Utah, say their clients are innocent. A sixth Blackwater contractor has already pleaded guilty in the case. The State Department has also said that Blackwater's contract to protect diplomats in Iraq may not be renewed. A decision on whether the contract will be renewed is expected next year after the FBI completes its investigation into the shooting incident.
(go to web site)

"A Traumatized Mumbai Seeks to Protect Itself"
Wall Street Journal (12/18/08) ; Bellman, Eric

An increasing number of citizens in Mumbai, India's business capital, are turning to private-sector security and emergency services because of frustration with local authorities for failing to stop the November terrorist attacks. India's Parliament on Dec. 17 approved tougher antiterrorism laws that allow the detention of alleged militants for up to 180 days, special courts to try suspects, and new police powers, and also approved a plan to set up an FBI-style counterterrorism agency. The terrorist attacks made many Mumbai residents feel vulnerable for the first time upon the realization that even the city's rich and powerful could be killed during dinner at hotel restaurants. Rajeev Sharma, president of the security firm Topsgrup, says "there has been an unprecedented rise in inquiries," asking about his services since the attacks, and he has run out of armed guards. The company employs more than 40,000 guards nationally, but most of them are unarmed because of tight government restrictions on gun licenses. Private emergency services also are expecting more attention because of the attacks. Sweta Mangal, the chief executive of a Mumbai ambulance service company called Dial 1298 for Ambulance, says its vehicles arrived at some of the attack sites before the police did. A witness from the restaurant Leopold's, one of the main targets in the attacks, also said the private companies' ambulances arrived before police.
(go to web site)

"Bush Prepares Crisis Briefings to Aid Obama"
New York Times (12/17/08) ; Baker, Peter

Recognizing that the nation could be vulnerable to a terrorist attack or other crisis during the transition from the Bush administration to the Obama administration, the White House has prepared more than 12 contingency plans that are designed to help President-elect Obama deal with an international crisis that occurs in the days after his inauguration. The plans deal with a variety of potential crises, such as a North Korean nuclear explosion, an attack on American computer systems, a terrorist attack on American facilities abroad, or instability in the Middle East. Each plan also contains a variety of possible responses that Obama could consider. The White House has also taken other steps to help the incoming administration, including developing as many as three dozen other long-term policy memorandums that discuss a variety of issues that Obama will have to deal with as president. In addition, senior counterterrorism officials are planning to hold briefings for their counterparts in the incoming administration on what they believe are the biggest issues the new administration will face. James Jay Carafano, a national security expert at the Heritage Foundation, noted that while the briefings and memorandum will be helpful, much of the government will know how to respond to any crisis that occurs. He noted that the most important thing Obama will have to focus on is projecting leadership. "For a president thinking about crisis management, the most important thing is not decision making, it's public relations," Carafano said.
(go to web site)

"India Will Set Up Federal Agency to Combat Terrorism"
Bloomberg (12/16/08) ; Pradhan, Bibhudatta

The Indian government announced plans to create a federal agency to combat the threat of terrorism. The government is in the process of overhauling its national security after a number of vulnerabilities were exploited during November's attack in Mumbai. Other security upgrades include better training for anti-terrorism officers, expanding intelligence gathering agencies, and strengthening India's coastal borders. Critics argue that the new National Investigating Agency will not have the funding and manpower necessary to adequately combat terrorism. Instead, one expert said that the most effective strategy would be bolstering the police. There are around 122 police officers for every 100,000 people in India, compared to an average of between 250 and 500 officers per 100,000 in Western countries. The Indian government also requested that Bangladesh crack down on militants who use the country as a staging area for attacks on India.
(go to web site)

"Scope of Obama's Secret Service Protection Proves Daunting"
USA Today (12/15/08) P. 1A ; Johnson, Kevin

Experts say that the inauguration of President-elect Barack Obama on Jan. 20--which is expected to draw several million people in Washington, D.C.--will be a massive challenge for the federal and regional authorities overseeing his protection. Obama was given Secret Service protection a year-and-a-half prior to the election partly due to concerns about racially-charged threats that had been directed towards him. Washington Assistant Police Chief Patrick Burke states that the inaugural security plan will entail an intelligence-gathering endeavor involving "the entire intelligence community." Overseen by the Secret Service, the plan is devised to prevent all potential threats, including those that could be initiated by hate groups. Former Secret Service agent Norm Jarvis explains the amount of security for any president is always at a continuous high, and that balancing security requirements with permitting the public access to a president is a constant challenge. With Obama, he adds, agents assigned to him will have the extra burden of protecting the nation's first African American president. Officials have been managing the Inauguration Day roles of nearly 60 federal, state, and local security groups, including the U.S. military. The Pentagon intends to deploy around 5,000 troops, a combination of personnel from each branch of service for both security and ceremonial reasons, the Armed Forces Inaugural Committee reports. Washington's police department is also working with 96 police agencies throughout the country that are dispatching 4,000 officers to help safeguard the event.
(go to web site)

"Yahoo Limits Retention of Personal Data"
New York Times (12/18/08) ; Helft, Miguel

Yahoo! has introduced a new data retention policy that reduces the amount of time the company holds some personally identifiable information related to searches. Under the policy, Yahoo! will delete the last eight bits of an IP address associated with a search query after 90 days. In addition, the policy will require cookie data related to search logs to be hidden and personally identifiable information such as names and Social Security numbers to be stripped from the search query itself. Under the company's old data retention policy, search logs were kept for 13 months. The new Yahoo! policy is the most restrictive among the major U.S. search engines and could put pressure on Google and Microsoft to adopt similar rules. However, the policy has been criticized by some, including Electronic Privacy Information Center Executive Director Marc Rotenberg, who said that deleting the last eight bits of an IP address would not guarantee users' privacy. He and others are calling on Yahoo! to follow Microsoft's lead by deleting the entire IP address.
(go to web site)

"Microsoft Issues Patch to Fix IE"
BBC News (12/18/08)

Microsoft has issued a patch that fixes a critical vulnerability in its Internet Explorer browser. The vulnerability, known as the AZN Trojan, installs malicious downloaders on victims' computers when they open an infected Web page. These downloaders then record keystrokes, passwords, credit card account information, and other types of financial data. So far, as many as 10,000 Web sites--most of which are hosted in China--have been affected by the vulnerability. In addition, more than 2 million Windows users have been attacked. Microsoft says the number of affected Web sites and users is growing at a rate of 50 percent a day. The attacks are spreading "like wildfire," says Trend Micro's Paul Ferguson. "This vulnerability is being actively exploited by cybercriminals and getting worse every day," he says. The patch is being released outside of Microsoft's regular monthly patch updates--something the company rarely does. Experts say this underscores the seriousness of the vulnerability.
(go to web site)

"New Top-Level Domain Plan Dangerous, Too Costly, Critics Tell ICANN"
Network World (12/15/08) ; Marsan, Carolyn Duffy

Many corporations and individual Internet users have criticized ICANN's proposed plan to create hundreds of new generic top-level domains (gTLDs). Dec. 15 was the final day for comments on ICANN's plan to launch between 200 and 800 new domain name extensions beginning in 2009. ICANN officials say the creation of new gTLDs will offer consumers more choice and fuel innovation and competition. The new domains also will support Chinese, Arabic, and other non-English scripts. Although the plan would allow most companies to run their own domains, most corporations have responded negatively due to the added expense of protecting their trademarks on hundreds of new domains. There are concerns that the creation of new domains will increase the amount of cybercrime, including cybersquatting, phishing scams, and online fraud. Companies have asked ICANN to require gTLD applicants to provide proof of ownership of a trademark before they purchase it. Another concern about ICANN's plan is the high cost of registering a new gTLD. ICANN is expected to charge a $185,000 application fee and a $75,000 annual fee to keep the gTLD in the DNS root zone. Even supporters of the plan say the proposed fees are too high, considering that ICANN is a nonprofit organization. ICANN also proposed a variable pricing scheme that would allow registries to charge more for Internet users to register more valuable domain names.
(go to web site)

"Modern Society Faces Growing Cyber-Terror Threat"
Taipei Times (12/15/08) ; Nye, Joseph

Governments have become increasingly vulnerable to cyber threats and potential cyber warfare due to the difficulty of identifying attackers. In September 2007, U.S. cyber defense professionals wrote an open letter to U.S. President George W. Bush, addressing vulnerabilities in other areas, as well, including finance, health care, and telecommunications. Other experts believe that cyber attackers could shut down a nation's power grid, or shut down commercial Web sites, wreaking economic havoc. In January, President Bush signed directives calling for the formation of a comprehensive cyber security plan, and his budget for 2009 requested $6 billion to develop a national cyber security system. According to U.S. Deputy Director of National Intelligence Donald Kerr, new technology is particularly threatening because governments are no longer the ones developing it. In deterring cyber crime, there needs to be a believable threat of response, a challenge if governments cannot be sure where the attack comes from. An international legal code to clearly define cyber attacks may help, but probably will not be sufficient, so governments must give cyber security high priority in their agendas.
(go to web site)

"Cisco: Cyberattacks Growing, Looking More Legit"
Network World (12/15/08) ; Duffy, Jim

The number and sophistication of cyberattacks increased during 2008, concludes the 2008 edition of Cisco's Annual Security Report. The report says that the overall number of disclosed vulnerabilities rose by 11.5 percent this year compared with 2007. In addition, the study fond that the number of vulnerabilities rose from 35 in 2007 to 103 in 2008, a nearly threefold increase. The report also says that the number of cyberthreats that originated from legitimate domains soared by 90 percent this year compared with 2007. Cybercriminals also are taking other steps to make their attacks look legitimate, the report reveals. For instance, the study points out that more cybercriminals are using real email accounts with legitimate Web mail providers to send out spam in order to make the unsolicited messages harder to detect and block. The report predicts that cybercriminals will increasingly use targeted phishing attacks--or spear-phishing--to trick victims into divulging personal information. Finally, the report identifies several trends IT security professionals need to be aware of during 2009, including an increase in insider attacks and the increasing usage of Web-based tools, mobile devices, virtualization, cloud computing, and similar technologies.
(go to web site)

Abstracts Copyright © 2008 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments: