Week in review: Facebook CSO interview, RSA Conference 2012 coverage
Here’s an overview of some of last week’s most interesting news, videos, interviews and podcasts:
RSA Conference 2012 coverage
Last week, the Help Net Security team was hard at work at the RSA Conference 2012 held in San Francisco. Visit our coverage page for an extensive list of news from the event.
Log management deserves a company’s respect
Why don’t more organizations take advantage of log analysis as a data security tool? Too expensive? Not enough resources? Too tedious to perform regular audits? All of these are common answers, but perhaps the most important factor is a general lack of understanding among key decision makers about the value of log maintenance and analysis.
Careless management of crucial security instruments
A staggering 72% of respondents to a Venafi survey admitted that they have no automated process to replace compromised certificates. This means that if their CA vendor is compromised they will be ignorant of where the offending certificates are and have no way of automatically locating and replacing them.
WikiLeaks publishes Stratfor emails stolen by Anonymou
WikiLeaks has begun publishing internal emails exfiltrated from the systems of strategic intelligence company Stratfor and has teamed up with 25 media organizations who will be going through them all, revealing the most interesting information to the public.
Design guidelines for mobile app privacy
The GSM Association (GSMA), with the support of mobile operators in Europe and following consultation across the wider mobile ecosystem, has published a set of global Privacy Design Guidelines for Mobile Application Development.
The true state of cloud security
Counter to the conventional wisdom that infrastructure in service provider managed cloud environments is inherently less secure, an analysis found these environments tend to face a lower level of risk than on-premise environments.
Compromised websites from a site owner’s perspective
Malicious actors are often able to compromise legitimate websites without the site owners’ knowledge: over 90% of respondents didn’t notice any strange activity, despite the fact that their sites were being abused to send spam, host phishing pages, or distribute malware.
Low Tech Hacking: Street Smarts for Security Professionals
When talking about hacking, many of us primarily think about software vulnerabilities, exploits, malware and coding. But as social engineering began to grab headlines, the world started becoming aware that there are many other, more low tech techniques that can allow an attacker to gain a foothold into a system or a physical location. This book explores these techniques and teaches readers how to spot them being used against them.
Interview with Joe Sullivan, CSO at Facebook
Joe Sullivan is the Chief Security Officer at Facebook, where he manages a small part of a company-wide effort to ensure a safe internet experience for Facebook users. He and the Facebook Security Team work internally to develop and promote high product security standards, partner externally to promote safe internet practices, and coordinate internal investigations with outside law enforcement agencies.
Alleged SMS Trojan makers indicted in France
The two – one of whom was allegedly the “brain” behind the operation and the other a tehnician – have been indicted on Friday in Bobigny, a small town in the northeastern suburbs of Paris, after a two-month-long investigation.
Competitors blamed for over half of the DDoS attacks in the US
One in three organizations (31%) has suffered one or more Distributed Denial of Service (DDoS) attacks in the last 12 months, according to independent research commissioned by Corero Network Security.
Only 34% of businesses enforce encryption on removable devices
Imation revealed the results of a recent survey of 302 IT decision makers in the US and Canada, which say that 37 percent of them reported that their business had unintentionally exposed corporate data through theft or loss of removable devices in the past two years.
Researchers work on self-healing cloud infrastructure
With funding from DARPA, researchers from the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL) aim to develop a new system that would help the cloud identify and recover from an attack almost instantaneously.
Infected government computers getting cleaned
As the date of the planned shutdown of the clean servers that constitute the only link to the Internet for the 400,000 or so computers still infected with the DNSChanger malware looms near, the US government is worried what about losing the infected computers that are used by many of its agencies.
25 alleged Anons arrested
25 individuals suspected to be Anonymous members have been arrested during a coordinated international operation supported by Interpol across four countries in Europe and Latin America.
“Free iPad 3” scams popping up
As Apple announced an event taking place on March 7 and speculations of it being the formal presentation of the new version of the iPad flooded the Internet, scammers have decided to take advantage of the frenzy.
New “HTTPS Everywhere” for Firefox and a beta for Chrome
The Electronic Frontier Foundation (EFF) launched the 2.0 version of HTTPS Everywhere for the Firefox browser today, including an important new update that warns users about web security holes.
Employees are deliberately disabling security controls
Corporate mobile devices and the bring-your-own-device (BYOD) phenomenon are rapidly circumventing enterprise security and policies.
Video: Trustworthy Internet Movement Initiative
Qualys CEO Philippe Courtot announces a new cross-industry, non-profit organization called the Trustworthy Internet Movement – a vendor-neutral organization with a mission to resolve major lingering security issues on the Internet, such as SSL governance and the spread of botnets and malware and to ensure that security is built into the very fabric of private and public clouds.
$2.1 million stolen with clever social engineering
An unnamed fraudster managed to steal $2.1 million from a hospital chain’s Wells Fargo Bank escrow account by faxing a money transfer signed with a copied-and-pasted signature he has taken off the Internet.
Encryption critical to improved security posture
Encryption is finally seen as a strategic issue and organizations are increasing their investment in encryption across the enterprise in response to compliance regulations and cyber-attacks.
The future of attacks on banking systems
User-oriented attacks are just the first evolutionary stage of this type of attacks, and given the amount of protective measures the banks implement to make these attacks harder and harder as time goes by, the criminals will have to shift to other targets soon. In this podcast, ACROS Security CEO Mitja Kolsek talks about the other two stages of banking attacks and about what we can expect in the future.
Video: RSA Conference 2012 showcase
The world’s top information security professionals and business leaders gathered in San Francisco for RSA Conference 2012. Here’s a closer look at the show.
Anonymous’ supporters tricked into installing Zeus
Anonymous supporters that joined Operation Megaupload got more than they bargained for when they downloaded what they believed was the Slowloris DoS tool from a Pastebin post.
Amphion Forum, a security event to watch
Kurt Stammberger is the VP of Market Development at Mocana and the Chair of the Amphion Forum. He is best known as the founder of the annual RSA Conference. He joined RSA Security as employee #7 in 1990, helped launch spin-off company VeriSign, and created the brand for the technology that now protects virtually every electronic commerce transaction on the planet. In this Q&A he shares why Amphion Forum is structured the way it is, how it changed since its inception and what you can expect at the event in Munich this March.