Articles from last posting
News update and link to Globe & Mail article- Decrypting the Future of Security
US banks required to report security breaches
Microsoft face $5 million a day fine from EU Commission
Chip based bank cards open to attack
Ericsson hacker gets three years
A 26 year old Hungarian hacker who accessed top secret Ericsson (the Swedish teleco) documents on their Intranet was sentenced to three years in jail. He broke into the system as a 'provocation', inexplicably with the hope that his wiliness would entice Ericsson to offer him a job.
However, his stated motivations for the attack do not appear to fit well with the facts, as he came a cropper when Swedish police busted him at Malmo airport, in the course of an undercover sting operation - after he attempted to sell some of the information he gleaned from Ericsson on the internet.
Would someone please tell all aspiring hackers that selling confidential corporate information - of keen interest to unscrupulous competitors - on the internet- will never, ever result in anything less than a criminal conviction. It will most certainly not place you in the corner office- except in handcuffs.
But the fact remains- how did he get in? No doubt some soul searching at Ericcson.
Biometric device costs Malaysian accountant his finger
An accountant in a Kuala Lumpur suburb in Malaysia had the top of his finger chopped off by a machete wielding carjacking gang when they couldn't get around the high tech biometric security system protecting his S- Class Mercedes.
They initially forced him to put his finger on the reader to start the vehicle, but later grew impatient when they couldn't restart it without his assistance, chopped off the end of his index finger and left him naked and bleeding on the side of the road.
Despite all the hoopla about the wonders of biometric devices, there is little attention paid to the methods determined criminals will use to subvert the technology.
Update - US banks required to report security breaches
Last week, we reported that the board of the FDIC (a US banking regulator) - as well as the OCC and the OTS - approved a proposal to require US banks to notify customers about security breaches that expose their data, in certain circumstances. The final rule can be located here.
I was gratified to read in the explanatory notes that a number of my comments filed during the submission process were taken on board, and are mentioned in the text- most expecially my suggestion that account monitoring (at a particular institution) may not reveal the full picture, as id thieves will routinely target additional financial institutions- to spread the risk of being caught, and maximize their illicit returns.
The FDIC response was not to mandate account monitoring and freezing in the final text of the Guidance (the credit check agencies were upset about freezing and anything that impacts their business model- see the Tips section for more on this theme). This may not have been the optimal response to a difficult problem, but probably was inevitable with the financial institutions generally in dread of the final proposal in any shape or form.
New risk based approach
The final Guidance - drawing heavily on the tough Security Guidelines under the Gramm Leach Bliley Act (GLB) - provides financial institutions with greater flexibility to 'design a risk-based response program tailored to the size, complexity and nature of its operations'. It requires them, broadly speaking, to prevent unauthorised access to customer data, and to alert regulators and customers in defined circumstances when there has been a breach.
Contract changes mandated with service providers
This obligation to protect customer data extends to contracts with third party service providers. Existing contracts that do not contain suitable provisions - requiring service providers, for instance, to notify their clients in the event of a breach - have not been grandfathered, but 'best efforts' have to be made to add such a clause. New contracts 'should include such a provision'.
Missed opportunity to solve dearth of data problem
Regulators must be advised in the event of a security breach that impacts 'sensitive data' (as defined).
As a result, can we expect a spike in the amount and quality of data available on security breaches- at least in the financial services sector? The absence of reliable data on the extent and frequency of the problem has been a long standing security conundrum.
Unfortunately, the final Guidance does not present a solution as whether or not an Agency will track the number of incidents reported 'is left to the discretion of individual Agencies'.
Notifying customers of a breach
The final Guidance provides that when an institution becomes aware of an incident of unauthorized access to sensitive customer information, 'it should conduct a reasonable investigation to determine promptly the likelihood that the information has been or will be misused. If the institution determines that misuse of the information has occurred or is reasonably possible, it should notify affected customers as soon as possible.
The notification can be delayed in the event of an ongoing criminal investigation.
Encrypting data no defence
Unlike security breach reporting laws such as SB 1386 in California, the Guidance does not exempt institutions from reporting incidents when the compromised data is encrypted. It acknowledges a reality those statutes ignore- that not all encryption is equal:
' The Agencies also believe that a blanket exclusion for all encrypted information is not appropriate, because there are many levels of encryption, some of which do not effectively protect customer information'.
Fear of embarrassment no answer either
The Agencies (regulators) also realize that the main reason that institutions do not currently report breaches is fear of embarrasement and bad PR. So they have explicitly stated that in cases where customer notification is warranted, 'an institution may not forgo notifying its customers of an incident because the institution believes that it may be potentially embarrassed or inconvenienced by doing so.'
Shining the light into other nooks and crannies
Banks have little choice but to comply or face the wrath of the regulators. They are inundated with compliance efforts - with teams working around the clock to satisfy corporate governance, SOX, and Basel II project requirements. Reporting security breaches is just one more to add to the list.
Perhaps it is now time- in the US at least- to look more closely at the other critical infrastructure sectors- where regulation is marked only by its absence and the threats are equally real.
And time to brainstorm ways to stop the blight of phishing and other scams.
'When the help help themselves'
A rather sobering tale in the American Bar Association Journal - that illustrates how susceptible we all are to non - technology based, good old fashioned insider fraud.
A lawyer was defrauded by his trusted office manager - who used his seal and wrote cheques in his name- to the tune of USD 1.2 million.
To add insult to injury, he only discovered the fraud when a friend told him he had been suspended from the practice of law - for failing to respond to Law Society complaints- the alleged fraudster destroyed them.
An insider threat survey (focused on the banking sector) conducted some time ago by the US Secret Service and CERT at Carnegie Mellon University was useful in highlighting the fact, albeit with the usual limited data, that insider fraud is often committed by non techies- people who simply watch and learn, and know how to work the system.
Remember- your main culprit may not be Techie Tom in the Penguin shirt, but rather seemingly gormless Molly who can barely work the coffee machine....
"Who dunnit? "- possible insider role in UK plot to steal STG 220m from Japanese bank
Insiders may have stuck again. Although happily this time they failed to execute their dastardly plan.
Security experts believe that a trojan horse key logger allegedly found on Sumitomo bank computers in London and used to send passwords and access information to criminals who intended to steal funds electronically, could only have been planted by an insider.
They maintain, quite logically (although it remains pure speculation at this juncture, details being sketchy) that it is extremely unlikely that a malicious key logger miraculously found its way onto a critical system from the outside, as a key component of the master heist plan.
They deem it far more likely that an insider played a role in installing the malicious software, and possibly covering his/her tracks. Not very well, as it turns out.
Police investigations are ongoing, but reports indicate that Yeron Bolondi, 32, was arrested by Israeli police on Wednesday after an attempt to transfer £13.9m to a bank account in the country. The UK's National Hi-Tech Crime Unit has been given credit for foiling what could have been one of the world's largest bank robberies.
A bank spokesman maintained that Sumitomo has not suffered any losses as a result of the foiled attempt to fleece them. One can only hope that such a positive prognosis extends to its customer base.
Key loggers take centre stage
Another banking scam, reported by AP, suggests that criminals are increasingly wise to the use of key loggers to perpetrate a wide range of crimes. They are particularly useful to glean banking details.
AP report that Estonian police detained a 24-year-old man suspected of 'emptying out hundreds of bank accounts in several European countries using the Internet. The suspect was detained after a yearlong investigation into what police believe could be the theft of millions of euros (dollars) from accounts in various banks in Estonia, Latvia, Lithuania, Germany, Britain and Spain'.
A spokesman for Estonia's central criminal police also stated that the suspect stole the money by infecting thousands of computers with a key logger that transmitted users bank account numbers and log in passwords to him. He got them to open the infected emails with the lure of job offers from 'apparently legitimate senders, such as government institutions, banks and investment firms'.
Yet again, human beings are shown to be demonstrably and incorrigibly weak- willed and prone to wishful thinking - with disastrous results.
|
