Internet Security Alliance Updates 6-17-09

June 17, 2009 by ADMIN

Share |

In Today’s News…

June 12, DarkReading – (International) Busted: international telephone hacking conspiracy. An indictment was unsealed on June 12 against three individuals who allegedly hacked into the telephone systems of large corporations and entities in the United States and abroad and sold information about the compromised telephone systems to Pakistani nationals residing in Italy, an Acting U.S. Attorney announced. Italian law enforcement conducted searches of approximately 10 locations in Italy and arrested the financiers of the hacking activity. Those financiers allegedly used the information to transmit over 12 million minutes of telephone calls valued at more than $55 million over the hacked networks of victim corporations in the United States alone. The investigation has been ongoing since 2006 and relates to conduct ranging from October 2005 through December 2008. As described in the indictment, two persons, residing in Italy, were among the financiers of the hacking and owned and operated call center operations in Italy from which their customers would make calls throughout the world. To increase their profits, they made efforts to incur as little costs as possible in routing their customers’ telephone calls to the intended call-recipient. They recruited the three individuals to hack into the telephone networks of unsuspecting large corporations and entities so that telephone calls from the call centers could be transmitted over the hacked networks. To accomplish their mission, the hackers gained an intimate familiarity with the programming of the public branch exchange (PBX) telephone systems. As the hackers dialed into the systems, they were able to identify the type of PBX system by the prompts and were thereby able to begin a process, known as a brute force attack, by which they sought to attack vulnerable points of the PBX systems. Often, the vulnerable points consisted of telephone extensions with default passwords still in place. AT&T was not hacked but was among the companies that carried the long-distance calls. In addition to the conspiracy count, each of the defendants is charged with two counts of unauthorized access to a computer system for purposes of committing fraud, and with the possession of unauthorized access devices, including passcodes to U.S. telephone systems.
Source:http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=217801056&subSection=Attacks/breaches

June 16, Washington Post – (International) Apple patches Java flaws, at last. Apple on June 15 shipped updates to plug more than two dozen security holes in its version of Java, including a particularly dangerous flaw that Java maker Sun patched back in early December. In May, Security Fix and others took Apple to task for taking too long to fix Java vulnerabilities. In fact, Apple patches Java flaws on average about six months after Sun had shipped its own updates to fix the same vulnerabilities. At least two different researchers even released proof-of-concept exploits to shame Apple into quickly fixing an easy-to-exploit vulnerability that potential attackers had known about for six months. This Java update appears to address most of the outstanding Java vulnerabilities. From looking at the common vulnerabilities and exposures (CVE) numbers attached to each of the flaws fixed by Apple’s Java rollup, it looks like this update brings Mac OS X systems to the equivalent of Java 6 Update 13 (Sun recently released Update 14, but there do not appear to be any security related fixes in that bundle).
Source:http://voices.washingtonpost.com/securityfix/2009/06/apple_patches_java_flaws_at_la.html?wprss=securityfix

June 15, Homeland Security Newswire – (International) Locating VoIP callers in emergencies. U.K. phone companies are developing a system to allow 999, the equivalent of the U.S. 911, operators to pinpoint the location of Internet callers, as concerns that the increasing use of VoIP could mean police, paramedics, and fire crews are unable to attend emergencies promptly. The hope is that the technology could be in place in some ISPs next year, according to the chairman of the industry group leading the work. The majority of calls to 999 are currently made via traditional landlines and mobile phones. BT has seen a ten-fold increase in the volume of VoIP calls to its emergency contact centers in the last 18 months, however. The ability to locate emergency calls is vital as callers may be under duress, too ill to speak, or may simply not know where they are. Traditional landlines can be found by what amounts to a reverse directory lookup, but using the line identity number and mobile phone coordinates approximated by triangulation, solving VoIP location is a more complex problem. Typically, VoIP users are allocated a number by their provider and are able to log in and make calls on any broadband connection. They could be at several sites in one day. That means a solution would require cooperation between VoIP providers and ISPs.
Source: http://homelandsecuritynewswire.com/single.php?id=8143

This Week at the ISAlliance…

Wednesday, June: 17 The Department of Homeland Security (DHS) Office of Cybersecurity and Communications (CS&C) National Cyber Security Division (NCSD), the Department of Defense (DoD) and National Institute for Standards and Technology (NIST) Information Technology Laboratory will host the Software Assurance Forum and Working Group Sessions. The SwA Forum and Working Groups bring together members of government, industry, and academia with vested interests in software assurance to discuss and promote integrity, security, and reliability in software. Progress updates on relevant programs and initiatives will be presented. If you are implementing practical solutions to problems related to examining alternatives to mitigate security risks attributable to software, then you should atte nd the Software Assurance Forum to better understand what others are doing and extend your network of collaborators. The key objective of the Software Assurance Forum is to shift the security paradigm from patch management to software assurance. This shift is designed to encourage software developers and consumers to raise overall software quality and security from the start, rather than relying on applying patches to systems after vulnerabilities are discovered. Recognizing that software security is fundamentally a software engineering issue that must be addressed in a systematic way throughout the software development life cycle, the SwA Forum encourages all software developers, from the public sector and private industry, to raise the standard on software quality and security. Moreover, the roles of consumers, as users of software, need to be better clarified to drive requirements for software assurance. Together, government, industry, and academia will raise expectation s for product assurance with requisite levels of integrity and secur i ty, by promoting security methodologies and tools as a normal part of business.

Thursday, June 18: The Department of Homeland Security (DHS) Office of Cybersecurity and Communications (CS&C) National Cyber Security Division (NCSD), the Department of Defense (DoD) and National Institute for Standards and Technology (NIST) Information Technology Laboratory will host the Software Assurance Forum and Working Group Sessions. The SwA Forum and Working Groups bring together members of government, industry, and academia with vested interests in software assurance to discuss and promote integrity, security, and reliability in software. Progress updates on relevant programs and initiatives will be presented. If you are implementing practical solutions to problems related to examining alternatives to mitigate security risks attributable to software, then you should attend the Software Assurance Forum to better understand what others are doing and extend your ne twork of collaborators. The key objective of the Software Assurance Forum is to shift the security paradigm from patch management to software assurance. This shift is designed to encourage software developers and consumers to raise overall software quality and security from the start, rather than relying on applying patches to systems after vulnerabilities are discovered. Recognizing that software security is fundamentally a software engineering issue that must be addressed in a systematic way throughout the software development life cycle, the SwA Forum encourages all software developers, from the public sector and private industry, to raise the standard on software quality and security. Moreover, the roles of consumers, as users of software, need to be better clarified to drive requirements for software assurance. Together, government, industry, and academia will raise expectations for product assurance with requisite levels of integrity and security, by promoting securit y methodologies and tools as a normal part of business.

Friday, June 19: ISAlliance/CyLab Webinar at noon. Ahead in the Cloud - The Power of Infrastructure as a Service by Dr. Werner Vogels, CTO of Amazon.com
Abstract: Building the right infrastructure that can scale up or down at a moment’s notice can be a complicated and expensive task, but it’s essential in today’s business landscape. This applies to an enterprise trying to cut-costs, a young business unexpectedly saturated with customer demand, or a start-up looking to launch. There are many challenges when building a reliable, flexible architecture that can manage unpredictable behaviors of today’s internet business. This presentation will review some of the lessons learned from building one of the world’s largest distributed systems; Amazon.com. The focus will be on state management which is one of the dominating factors in the scalability, reliability, performance and cost-effectiveness of the overall system.

Friday, June 19: Communications Sector Coordinating Council Executive Committee meeting at 2. The broad purpose of a Sector Coordinating Council is to foster and facilitate the coordination of sector-wide activities and initiatives designed to improve physical and cyber security of the critical infrastructures and related information flow within the sector, cross-sector and with DHS. Through the CSCC, private-sector owners, operators and suppliers can efficiently engage DHS and other federal agencies, collaborating to identify, prioritize, and coordinate policy issues related to the protection of critical infrastructure and key resources; facilitate sharing of information related to physical and cyber threats, vulnerabilities, incidents, potential protective measures, and best practices; facilitate policy issues related to response and recovery activities and communication following an incident or event. The Executive Committee manages the af fairs of the CSCC in the same way that a board of directors would manage the affairs of a “for profit” company.

Monday, June 22: Department of Homeland Security Control Systems Security Program 2009 Industrial Control Systems Cyber Security Advanced Training. This event will provide intensive hands-on training on protecting and securing control systems from cyber attacks, including a Red Team / Blue Team exercise that will be conducted within an actual control systems environment. It will also provide an opportunity to network and collaborate with other colleagues involved in operating and protecting control systems networks. This event includes four full days of intensive control systems security training, presentations and a Red Team / Blue Team exercise.

Monday, June 22: Fundamentals of Incident Handling training course by CyLab/Software Engineering Institute This five-day course is for computer security incident response team (CSIRT) technical staff who have little or no incident handling experience. It provides a basic introduction to the main incident handling tasks and critical thinking skills that will help an incident handler perform their daily work. It is recommended to those new to incident handling work. The course is designed to provide insight into the work that an incident handler may perform. It will provide an overview of the incident handling arena, including CSIRT services, intruder threats, and the nature of incident response activities. Course attendees will learn how to gather the information required to handle an incident; realize the importance of having and following pre-defined CSIRT policies and procedures; understand the technical issues relatin g to commonly reported attack types; perform analysis and response tasks for various sample incidents; apply critical thinking skills in responding to incidents, and identify potential problems to avoid while taking part in CSIRT work. The course incorporates interactive instruction, practical exercises, and role playing. Attendees have the opportunity to participate in sample incidents that they might face on a day-to-day basis. This course is part of the curriculum for the CERT-Certified Incident Handler program. After completing this course, participants are encouraged to attend the companion course, Advanced Incident Handling. Note: There is significant content overlap between the Fundamentals of Incident Handling course and the Managing CSIRTs course. We recommend that attendees register for one course or the other, but not both. The Fundamentals of Incident Handling course covers more technical topics such as email and malware attacks, PGP, and recognizing signs of att ack. The Fundamentals of Incident Handling course is designed to int roduce new incident handlers to the basic skills and processes they will need to perform incident handling work. The Managing CSIRTs course focuses on incident handling issues from an operational management perspective.

Monday, June 22: Communications Sector Coordinating Council (CSCC) Communications and Outreach Committee working group meeting at 3. The Communications and Outreach Committee creates and maintains all communications documents. This working group reaches out across both sectors and states, spreading awareness of CSCC efforts and accomplishments. Some of these tasks are supported by the Executive Secretariat.

Tuesday, June 23: ISAlliance/NIST/DHS VoIP & Unified Communications Automated Security and Assurance Project Applicability Workgroup meeting at 1. This workgroup is focusing on documenting the SCAP Goals for a VoIP solution, identifying SCAP gaps and determine how SCAP may, or may not be applied to a non-desktop environment. The group will also review the SCAP components and standards and determine gaps and short falls of the SCAP components for applicability to a VoIP solution. This work will result in a whitepaper that captures the analysis, its results and makes recommendations regarding SCAP applicability to a VoIP Solution. The goal of this project is to provide a secure playing field for corporations as they deploy VoIP and related technologies.

Tuesday, June 23: Department of Homeland Security Control Systems Security Program 2009 Industrial Control Systems Cyber Security Advanced Training. This event will provide intensive hands-on training on protecting and securing control systems from cyber attacks, including a Red Team / Blue Team exercise that will be conducted within an actual control systems environment. It will also provide an opportunity to network and collaborate with other colleagues involved in operating and protecting control systems networks. This event includes four full days of intensive control systems security training, presentations and a Red Team / Blue Team exercise.

Tuesday, June 23: Fundamentals of Incident Handling training course by CyLab/Software Engineering Institute This five-day course is for computer security incident response team (CSIRT) technical staff who have little or no incident handling experience. It provides a basic introduction to the main incident handling tasks and critical thinking skills that will help an incident handler perform their daily work. It is recommended to those new to incident handling work. The course is designed to provide insight into the work that an incident handler may perform. It will provide an overview of the incident handling arena, including CSIRT services, intruder threats, and the nature of incident response activities. Course attendees will learn how to gather the information required to handle an incident; realize the importance of having and following pre-defined CSIRT p olicies and procedures; understand the technical issues relating to commonly reported attack types; perform analysis and response tasks for various sample incidents; apply critical thinking skills in responding to incidents, and identify potential problems to avoid while taking part in CSIRT work. The course incorporates interactive instruction, practical exercises, and role playing. Attendees have the opportunity to participate in sample incidents that they might face on a day-to-day basis. This course is part of the curriculum for the CERT-Certified Incident Handler program. After completing this course, participants are encouraged to attend the companion course, Advanced Incident Handling. Note: There is significant content overlap between the Fundamentals of Incident Handling course and the Managing CSIRTs course. We recommend that attendees register for one course or the other, but not both. The Fundamentals of Incident Handling course covers more technical topics such as email and malware attacks, PGP, and recognizing signs of attack. The Fundamentals of Incident Handling course is designed to introduce new incident handlers to the basic skills and processes they will need to perform incident handling work. The Managing CSIRTs course focuses on incident handling issues from an operational management perspective.

Wednesday, June 24: IT Sector Coordinating Council Communications and Outreach Committee working group meeting at 10. The Communications and Outreach Committee creates and maintains all communications documents. These documents include the ITSCC 101 presentation, the IT Sector Scorecard, the PCIS Handbook, and the website. This working group reaches out across both sectors and states, spreading awareness of IT SCC efforts and accomplishments. Some of these tasks are supported by the Executive Secretariat.

Wednesday, June 24: Department of Homeland Security Control Systems Security Program 2009 Industrial Control Systems Cyber Security Advanced Training. This event will provide intensive hands-on training on protecting and securing control systems from cyber attacks, including a Red Team / Blue Team exercise that will be conducted within an actual control systems environment. It will also provide an opportunity to network and collaborate with other colleagues involved in operating and protecting control systems networks. This event includes four full days of intensive control systems security training, presentations and a Red Team / Blue Team exercise.

Wednesday, June 24: Fundamentals of Incident Handling training course by CyLab/Software Engineering Institute This five-day course is for computer security incident response team (CSIRT) technical staff who have little or no incident handling experience. It provides a basic introduction to the main incident handling tasks and critical thinking skills that will help an incident handler perform their daily work. It is recommended to those new to incident handling work. The course is designed to provide insight into the work that an incident handler may perform. It will provide an overview of the incident handling arena, including CSIRT services, intruder threats, and the nature of incident response activities. Course attendees will learn how to gather the information required to handle an incident; realize the importance of having and following pre-defined CSIRT policies and procedures; understand the technical issues relati ng to commonly reported attack types; perform analysis and response tasks for various sample incidents; apply critical thinking skills in responding to incidents, and identify potential problems to avoid while taking part in CSIRT work. The course incorporates interactive instruction, practical exercises, and role playing. Attendees have the opportunity to participate in sample incidents that they might face on a day-to-day basis. This course is part of the curriculum for the CERT-Certified Incident Handler program. After completing this course, participants are encouraged to attend the companion course, Advanced Incident Handling. Note: There is significant content overlap between the Fundamentals of Incident Handling course and the Managing CSIRTs course. We recommend that attendees register for one course or the other, but not both. The Fundamentals of Incident Handling course covers more technical topics such as email and malware attacks, PGP, and recognizing signs of at tack. The Fundamentals of Incident Handling course is designed to in troduce new incident handlers to the basic skills and processes they will need to perform incident handling work. The Managing CSIRTs course focuses on incident handling issues from an operational management perspective.

Thursday, June 25: ISAlliance/NIST/DHS VoIP & Unified Communications Automated Security and Assurance Project Baseline Standards Workgroup meeting at 1. This workgroup is focusing on documenting the SCAP Goals for a VoIP solution, identifying SCAP gaps and determine how SCAP may, or may not be applied to a non-desktop environment. The group will also review the SCAP components and standards and determine gaps and short falls of the SCAP components for applicability to a VoIP solution. This work will result in a whitepaper that captures the analysis, its results and makes recommendations regarding SCAP applicability to a VoIP Solution. The goal of this project is to provide a secure playing field for corporations as they deploy VoIP and related technologies.

Thursday, June 25: Department of Homeland Security Control Systems Security Program 2009 Industrial Control Systems Cyber Security Advanced Training. This event will provide intensive hands-on training on protecting and securing control systems from cyber attacks, including a Red Team / Blue Team exercise that will be conducted within an actual control systems environment. It will also provide an opportunity to network and collaborate with other colleagues involved in operating and protecting control systems networks. This event includes four full days of intensive control systems security training, presentations and a Red Team / Blue Team exercise.

Thursday, June 25: Fundamentals of Incident Handling training course by CyLab/Software Engineering Institute This five-day course is for computer security incident response team (CSIRT) technical staff who have little or no incident handling experience. It provides a basic introduction to the main incident handling tasks and critical thinking skills that will help an incident handler perform their daily work. It is recommended to those new to incident handling work. The course is designed to provide insight into the work that an incident handler may perform. It will provide an overview of the incident handling arena, including CSIRT services, intruder threats, and the nature of incident response activities. Course attendees will learn how to gather the information required to handle an incident; realize the importance of having and following pre-defined CSIRT policies and procedures; understand the technical issues relatin g to commonly reported attack types; perform analysis and response tasks for various sample incidents; apply critical thinking skills in responding to incidents, and identify potential problems to avoid while taking part in CSIRT work. The course incorporates interactive instruction, practical exercises, and role playing. Attendees have the opportunity to participate in sample incidents that they might face on a day-to-day basis. This course is part of the curriculum for the CERT-Certified Incident Handler program. After completing this course, participants are encouraged to attend the companion course, Advanced Incident Handling. Note: There is significant content overlap between the Fundamentals of Incident Handling course and the Managing CSIRTs course. We recommend that attendees register for one course or the other, but not both. The Fundamentals of Incident Handling course covers more technical topics such as email and malware attacks, PGP, and recognizing signs of att ack. The Fundamentals of Incident Handling course is designed to int roduce new incident handlers to the basic skills and processes they will need to perform incident handling work. The Managing CSIRTs course focuses on incident handling issues from an operational management perspective.

Friday, June 26: Department of Homeland Security Control Systems Security Program 2009 Industrial Control Systems Cyber Security Advanced Training. This event will provide intensive hands-on training on protecting and securing control systems from cyber attacks, including a Red Team / Blue Team exercise that will be conducted within an actual control systems environment. It will also provide an opportunity to network and collaborate with other colleagues involved in operating and protecting control systems networks. This event includes four full days of intensive control systems security training, presentations and a Red Team / Blue Team exercise.

Friday, June 26: Fundamentals of Incident Handling training course by CyLab/Software Engineering Institute This five-day course is for computer security incident response team (CSIRT) technical staff who have little or no incident handling experience. It provides a basic introduction to the main incident handling tasks and critical thinking skills that will help an incident handler perform their daily work. It is recommended to those new to incident handling work. The course is designed to provide insight into the work that an incident handler may perform. It will provide an overview of the incident handling arena, including CSIRT services, intruder threats, and the nature of incident response activities. Course attendees will learn how to gather the information required to handle an incident; realize the importance of having and following pre-defined CSIRT policies and procedures; understand the technical issues relating to commonly reported attack types; perform analysis and response tasks for various sample incidents; apply critical thinking skills in responding to incidents, and identify potential problems to avoid while taking part in CSIRT work. The course incorporates interactive instruction, practical exercises, and role playing. Attendees have the opportunity to participate in sample incidents that they might face on a day-to-day basis. This course is part of the curriculum for the CERT-Certified Incident Handler program. After completing this course, participants are encouraged to attend the companion course, Advanced Incident Handling. Note: There is significant content overlap between the Fundamentals of Incident Handling course and the Managing CSIRTs course. We recommend that attendees register for one course or the other, but not both. The Fundamentals of Incident Handling course covers more technical topics such as email and malware attacks, PGP, and recognizing signs of attac k. The Fundamentals of Incident Handling course is designed to intro duce new incident handlers to the basic skills and processes they will need to perform incident handling work. The Managing CSIRTs course focuses on incident handling issues from an operational management perspective.

Adapting the SAFETY Act to Cyber Security - ISAlliance Member Assistance Program: Following the 911 catastrophe Congress passed a new law, the SAFETY Act, which provided market incentives for technologies to fight terrorism, most of which dealt with physical attacks. The SAFETY Act office approached ISA for assistance in getting cyber technologies designated or certified as SAFETY Act compliant. Designation brings with it various market advantages including liability protection and marketing benefits. ISA is arranging for individual members to receive attention for their technol ogies with the SAFETY Act office . Please contact bfoer@isalliance.org to discuss ISAlliance assistance and review which of your technologies are eligible under this program.

ISAlliance/NIST/DHS VOIP SECURITY PROGRAM - CALL TO PARTICIPATE

As you may be aware, ISAlliance is leading a project to develop an industry led, cost effective SCAP solution for VoIP and Unified Communications with the goal of providing a secure playing field for corporations as they deploy VoIP and related technologies. We are currently seeking workgroup participants with expertise in VoIP systems, VoIP Security Standards, Cybersecurity or SCAP. Volunteers may participant in one, or both of the following workgroups:

Applicability – Meets by phone conference every-other Tuesday from 1 to 2 PM Eastern. This workgroup is focusing on documenting the SCAP Goals for a VoIP solution, identifying SCAP gaps and determine how SCAP may, or may not be applied to a non-desktop environment. The group will also review the SCAP components and standards and determine gaps and short falls of the SCAP components for applicability to a VoIP solution. This work will result in a whitepaper that captures the analysis, its results and makes recommendations regarding SCAP applicability to a VoIP Solution.

Skills Sought for Participation: Expertise in VoIP systems, cybersecurity or SCAP.

Baseline Standards – Meets by phone conference every-other Thursday from 1 to 2 PM Eastern. This workgroup is focused on cataloging all relevant industry security, configuration and compliance standards and best practices for possible inclusion and enumeration by SCAP components. These will be reviewed and analyzed to identify potential gaps and shortcomings. Analysis of how updates to standards and best practices will be implement using SCAP components and standards, including identification of potential shortcomings of SCAP as applicable to VoIP will be performed. The results of this analysis will be presented in a whitepaper. Shortcomings in the standards and/or the SCAP components will be document and referred back to the appropriate responsible party .
Skills Sought for Participation: Expertise in VoIP systems, cybersecurity or SCAP.

ISAlliance Members Invited to Particpate in Nortel Voice Security Technology Blog. The voice security technology blog is meant to allow readers to keep informed about news and events around the world of voice and multimedia security from a technical perspective. It is a forum where the industry’ s best and brightest minds can cooperatively discus s and debate the hottest issues and topics facing secure voice, multimedia and unified communications. This b log will be of interest to those who are actively involved in providing security solutions, services or products, specifically those related to voice and multimedia communications.

ISAlliance US-CERT Portal: https://portal.us-cert.gov/member/index.cfm

ISAlliance/CyLab Portal: www.cylab.cmu.edu/

* * *

Stay Informed With ISR News Feeds and Email Alerts Here:

The Publisher gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to Information-Security-Resources.com

These icons link to social bookmarking sites where readers can share and discover new web pages.