Tag Archive for: protections

FireEye, SolarWinds Breaches: Implications and Protections

/in


Five days after FireEye detailed the theft of about 300 of its proprietary cybersecurity tools, SolarWinds announced that its Orion IT monitoring platform had also been compromised by hackers believed to be sponsored by the Russian government. Together, the attacks turned over critical cybersecurity infrastructure to the malicious actors, along with access to thousands of global entities’ sensitive information. As the cybersecurity world wraps its head around how two top vendors were breached, we examine the organizations involved, details of the attack, and implications for the industry and its customers.

The players

While FireEye and SolarWinds are familiar to IT professionals, this week’s news brought their brands to the dinner table. Before jumping into the attacks and implications, here is a quick look at the two key organizations getting the most attention.

FireEye

Since 2004, FireEye has made a name for itself by offering next-generation threat protection and specializing in detection, prevention, and cyberattack analysis. In 2015, Deloitte called the vendor the fastest-growing cybersecurity firm, and today it stands out as a leading identifier of global threats and actors. Earlier this year, Reuters reported on FireEye’s research into APT41, a Chinese-linked cyberespionage actor. FireEye’s security services are used by government agencies and top public and private companies internationally.

SolarWinds

SolarWinds, operating out of Austin, Texas, since 2005, offers a suite of IT products from network, systems, and database management to managed security services. In April, Gartner recognized SolarWinds in its Magic Quadrant for Application Performance Monitoring (APM). As evidence of its reputation, SolarWinds global customers include about 80 percent of the Fortune 500 companies, all five branches of the U.S. military, and a swath of high-level government agencies.

Also read: Top Endpoint Detection and Response (EDR) Security Solutions

The attacks

Earlier this month, the U.S. National Security Agency warned that federal agencies were actively being exploited by “Russian state-sponsored actors.” A week later, FireEye’s prized Red Team hacking tools were…

Source…

Home Affairs likens critical infrastructure protections to insurance and crime-fighting

/in


The federal government in November published an exposure draft on the Security Legislation Amendment (Critical Infrastructure) Bill 2020, which seeks to amend the Security of Critical Infrastructure Act 2018 (SOCI) to implement “an enhanced framework to uplift the security and resilience of Australia’s critical infrastructure”.

If passed, SOCI would create a new class of regulated entities known as “systems of national significance“, which Secretary for the Department of Home Affairs Mike Pezzullo has labelled the most profoundly important segments of national infrastructure: Gas, water, power, and banking.

It would create mandatory reporting loops between the sector and the Australian Cyber Security Centre, allowing the responsible minister to designate a sector as being so sensitive that the Australian Signals Directorate (ASD) would be on the network and perform monitoring.

But not everyone, Pezzullo noted, would get that ASD-level protection under SOCI as the economy is just too large.

See also: Tech giants not convinced Australia’s critical infrastructure Bill is currently fit for purpose

Facing the Legal and Constitutional Affairs Legislation Committee on Friday, Pezzullo was asked if looking after the “top tier” would result in the needs of the “middle tier” being neglected. He was also asked to expand on what the government’s view of its responsibility is.  

“There are two strands here. It’s like general crime. Governments frame insurance markets — people take out insurance — but they also fight crime,” he said.

“Right down to the household level, you’re expected as part of your household insurance to secure your property with alarms and locks et cetera — and that affects the premium, but that doesn’t prevent the police — in fact, the police actively go after the criminals who might be doing break-and-enter. Cyber is no different.”

The element that’s missing, he said, continuing the insurance metaphor, is what the cost is, in an actuarial sense, that both households and firms would be willing to bear in order to provide a certain level of protection.

“Then the government strikes at the attacker, or strikes at…

Source…

European Commission Wants Coronavirus Tracing Apps To Build In Strong Protections For Privacy — Unlike The French Government

/in

Techdirt has just written about France’s incredibly hypocritical attitude to privacy when it comes to contact tracing apps for COVID-19. The European Commission seems to be rather more consistent in this area. As well as pushing privacy legislation like the GDPR and ePrivacy Directive, it has released a series of documents designed to help EU Member States create tracing apps without compromising on citizens’ privacy. For example, on April 8, it adopted a “Recommendation to support exit strategies through mobile data and apps”, which called for “a joint toolbox towards a common coordinated approach for the use of smartphone apps that fully respect EU data protection standards”. Details followed a week later, when the European Commission announced a pan-EU toolbox for “efficient contact tracing apps to support gradual lifting of confinement measures”. A 44-page document spelled out in some detail (pdf) the “essential requirements” for national apps deployed in the region — that they should be:

voluntary;

approved by the national health authority;

privacy-preserving — personal data is securely encrypted; and

dismantled as soon as no longer needed.

Finally, as if to underline the importance of respecting citizens’ privacy yet further, the European Commission released another communication (pdf) providing “Guidance on Apps supporting the fight against COVID 19 pandemic in relation to data protection”. The whole section on security is worth reading in full, since it offers a good summary of the current thinking on the best ways to preserve privacy with these apps:

The Commission recommends that the data should be stored on the terminal device of the individual in an encrypted form using state-of-the art cryptographic techniques. In the case that the data is stored in a central server, the access, including the administrative access, should be logged.

Proximity data should only be generated and stored on the terminal device of the individual in encrypted and pseudonymised format. In order to ensure that tracking by third parties is excluded the activation of Bluetooth should be possible without having to activate other location services.

During the collection of proximity data via [Bluetooth Low Energy communications between devices] it is preferable to create and store temporary user IDs that change regularly rather than storing the actual device ID. This measure provides additional protection against eavesdropping and tracking by hackers and therefore makes it more difficult to identify individuals.

The Commission recommends that the source code of the app should be made public and available for review.

Additional measures to secure the data processed can be envisaged notably with automatic deletion or anonymisation of the data after a certain point in time. In general, the degree of the security should match the amount and sensitivity of personal data processed.

All transmissions from the personal device to the national health authorities should be encrypted.

The contrast between this rigorous and comprehensive approach to safeguarding the rights of citizens and France’s cavalier disregard for the same, is stark. Unfortunately the Commission’s guidance is not legally binding and is likely to be ignored by the French government, which often insists on going its way, as with its terrible implementation of Article 17 of the EU Copyright Directive.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Techdirt.

Android “Ghost Click” Apps, New Apple Siri Privacy Protections, Credit Card Spying – Security Boulevard

/in

Android “Ghost Click” Apps, New Apple Siri Privacy Protections, Credit Card Spying  Security Boulevard

You’re listening to the Shared Security Podcast, exploring the trust you put in people, apps, and technology…with your host, Tom Eston. In episode 84 for …

“android security news” – read more