US power grid is highly vulnerable and under constant attack, Iran attacking energy companies, increase in sophisticated attacks against keys and certificates, Indian government site redirects to black hole exploit kit, FSB report find that only 36% of small businesses regularly patch, 5 quick wins from the DBIR, Google to give software vendors 7 days prior to releasing information on active exploits, and planning for the failure of malware prevention.
I am here on vacation in Disney World, using wifi in the hotel and I’m being blocked.
Disney appears to be using an old (I mean old) web filter called the 8e6 R3000 from 8e6 Technologies, now Trustwave. Interestingly, when I check this site’s category using Trustwave’s site here and it is not registered. The site is correctly categorized as “IT” in the other filtering engines.
So, it would seem that Disney World is keying off some element of content on the site, rather than on the Skye’s categorization.
This week: Twitter warns news agencies of attacks and to use dedicated PCs for using twitter, the US department of Labor website was compromised and serving up an 0day for IE8, 18 12-13 year olds in Alaska socially engineered passwords for 300 computers out of their teachers, iOS did NOT have a malicious app discovered, AV vendors are starting to shun Windows XP, 7 elements of a successful security awareness program, and the unforeseen impacts of cyberwar.
In this episode, another Java 0day, Symantec’s Q1 2013 0day roundup, the Akamai State of the Internet report, the Verizon 2013 DBIR, AP’s twitter feed hack, and cyber terrorists.
This week: Twitter account hacks highlight opportunity for exploitation by attackers, Microsoft and Malwarebytes both release bad patches, Oracle releases a Java patch which fixes 42 security bugs, Oracle announces that Java 8 is delayed due to the focus on Java 7, a new botnet is being created by compromising WordPress installations for some unknown purpose, Linode was compromised in an attack targeted at some Linode customers, Microsoft finds a trojan that cleans up after itself in the next wave of anti-forensics, the Boston marathon bombing and West, Texas explosions see many phishing scams leading to malware installations, spam is down, targeted attacks via email are up, Microsoft released it’s second half 2012 Security Intelligence Report with some odd mixes of data, Microsoft releases EMET 4.0 beta, and a former employee has been charged with planting back doors on 2723 Hostgator servers.
I’ll be picking someone to give an e-copy of @Taosecurity’s new book “The Practice of Network Security” who sends me an email with feedback on the show.
Encrypt your drives, eve. If you don’t think the computer will leave the office: http://feedly.com/k/ZM172z
Spate of MS and Adobe patches fix numerous remote code execution and priv escalation bugs
SEC filings seem to disagree with the growing furor over cyber attacks: http://feedly.com/k/ZM1IRB
Bruce Schneier recently wrote a blog post about the value of security training on Dark Reading that is a bit provocative. Similar to the comments Dave Aitel made last year, Bruce asserts that money spent on education is more useful if spent elsewhere on improving security.
I both strongly agree and disagree with this position. Before you assume I am copping out of taking a stance, let me explain. It’s my experience that there are some things worth teaching and others that have little value:
Choosing a strong password – little value
Understanding that AntiVirus can’t protect against many threats – pretty valuable
And so it goes.
I’ve found that it is nearly useless to try to train people on password etiquette for a number of reasons. They don’t care; they don’t believe that it really matters; they are prompted to choose a password at a very inopportune time; they really believe that Password1 is strong. This is an area where it is far better to focus efforts on improving the technical control than spending a bunch of money on more training. Set the minimum password length to 20 characters and give everyone a password manager – oh and make sure that they can’t pick abcdefghijklmnopqrs as their password.
But in other areas, we are forced to rely on trying to hone the imperfect mind. Recognizing phishing emails and understanding that AV is not perfect are important, because we can’t enable a setting to make people safe. I suspect we all wish the world would invest in writing more secure software, and despite appearances, we are trying but the tactics for finding weaknesses grow ever more ingenious. I can’t envision a future where we have solved the problem, despite diverting all training spending on better development practices. So we are left trying to find innovative ways to get people to change their behavior, even if slightly.
I can’t count the number of times employees have expressed surprise and frustration that potentially malicious files might end up in their email inboxes. “How is it possible that a virus can get to my inbox if we are using AV?”
To me, it seems like the trick is figuring out which aspects of security to focus training on, and which can and should be addressed with technology.
On a related topic, I have been working on some security education and have been thinking about how to make it more engaging. I recently flew Delta from Atlanta to Las Vegas and noticed that the airline had remade their safety videos. I have flown hundreds of times and find those videos a bit of a bore, but I was captivated. Delta worked in some very humorous elements into the safety video – from a man using a typewriter on a tray table and needing to stow it, to a man in a neck brace unable to look behind him for the nearest exit, to a posted placard that prohibits comb-overs. I couldn’t stop watching and listening to catch the subtle humor that was being presented. On the return flight, I found that the video was mostly different, and so I needed to pay close attention again to get the new jokes. Brilliant move by Delta, in my opinion. I would love to come up with a way to do something similar in my security education programs.