Corporate Training by XCySS (21-24)

21	Lead Auditor ISO 27001	40 Hrs	4	ISO 27001 Lead Auditor	Auditors, IT staff
22	Internal Auditor ISO 27001	16 Hrs	6		Internal auditors and It staff
23	Information Security awareness course for ISO 27001 compliance	8 Hrs	25		For compliance with clause 4, 5 and 10A of ISO 27001
24	Training for CISSP	40 Hrs	4		CISSP certification preparation for experiencedInfosecprofessionals

Visit : http://www.xcyss.in/corporate-training  

Cybercrime bullseye: Porn surfing males

By Athima Chansanchai

Hold onto your hot beverage, because we're about to tell you something shocking: young men who like to surf online for porn and dates are most at risk to being victimized by cybercrime, according to a new report by security experts.

But the Norton Cybercrime Report 2011 does reveal some things that aregenuinely alarming: that at $388 billion, the cost of cybercrime is bigger than the global black market of marijuana, cocaine and heroine combined ($288 billion). Broken down, that's $114 billion stolen by "cyberthugs" or spent dealing with cyberattacks and $274 billion worth of time victims said they lost to cybercrime.

It victimizes one million people a day. A day! In the past 12 months, there have been more victims of cybercrime than there are people in the U.S. You don't have to leave home to get mugged nowadays, folks. You don't even have to leave your beds. The survey found three times as many people suffered from cybercrime as they did offline crime.

Cybercriminals will also find you wherever you are: 10 percent of the more than 12,000 adults surveyed had been a victim of crime through their mobile phones. (Norton conducted nearly 20,000 interviews, including the 12,000+ adults, more than 4,500 children and almost 2,400 teachers.) 

A few factors make it more likely to land in the cybercrime hot zone:

• the hours you're online (more than 24 hours a week)
• the state of development in the country in which you reside (80 percent vs. 64 percent in first world markets)
• age (three out of four millennials ages 18 to 31 compared to 61 percent of baby boomers) and
• gender (72 percent of the victims' pool are men, vs. 65 percent female adults)
• risky online surfing habits (80 percent of those who viewed "adult content," aka porn, have experienced cybercrime vs. 67 percent who haven't) and 78 percent of online liars (vs. 59 percent who choose to tell the truth and nothing but it online).

While we know this must come as a blow to everyone who thinks it's safe to follow those links that promise a good time tonight, or that taking the gamble is worth the payoff, it should serve as a cautionary tale.

The report shows that while nearly 9 in 10 adults tell surveyers it's important for security software to protect their computer 100 percent of the time, only a fifth (21 percent) who have installed such software feel it protects them 100 percent of the time.

Joseph LaBrie, an associate professor at Loyola Marymount University, was quoted in the report with some remarks about this "cyberapathy":

This shows an emotional disconnect between what people think is important and what they’re actually doing to protect themselves against cybercrime. Often, because people feel the Internet is too complicated and the threats are unknown or ambiguous, they default to a learned helplessness where they simply accept cybercrime as part of the cost of going online.

Also, they cannot visualize online protection like they can with offline security systems like a fence or alarm that act as a physical deterrent.

 So, if nothing else, try to become less apathetic. It could save you a lot of time — and money.

Solutions : www.xcyss.in

Closer ties with the US over cyber crime and missile defence (Australia)

By Greg Ansley

TONY EASTLEY: The Foreign Minister, Kevin Rudd, and Defence Minister, Stephen Smith, are in the US discussing with Hillary Clinton and other US counterparts closer ties between their countries.

The United States and Australia have agreed to modernise their alliance and toughen up their stance against cyber terrorism.

The Defence Minister, Stephen Smith, joins us now from the AUSMIN talks in San Francisco.

Minister, good morning.

So these closer ties that you talk about, does that mean missile defence as well?

STEPHEN SMITH: Yes, we spoke about ballistic missile defence but on the alliance itself, we had the annual AUSMIN talks - the Australia/US ministerial talks coincide this year with the 60th anniversary of the ANZUS Treaty. And we've made it clear that just as 10 years ago we saw the ANZUS Treaty invoked for something that people who signed the treaty originally would never have envisaged, namely international terrorism, so today we see the possibility of the treaty being invoked in an extensive cyber attack.

So it shows that our alliance with the United States which has been the bedrock of our strategic security and defence arrangements for 60 years continues to grow, continues to modernise, continues to adapt.

TONY EASTLEY: If I can bring you back to this missile technology, what do we have to offer the Americans on this?

STEPHEN SMITH: Uh, we have made it clear through our White Paper that missile, ballistic missile delivery systems is a potential threat so far as Australia or Australian Defence Force personnel is concerned - either in theatre or by way of tactical use. There is a ballistic missile threat out there.

TONY EASTLEY: Where is it coming from?

STEPHEN SMITH: Well, I can give you one example and that is North Korea. There is no doubt that is a risk to the international community but it is also the fact that these days with ballistic missile delivery systems that you can utilise conventional weapons, not just nuclear weapons.

So we have spoken about ballistic missile defence with the United States before in that sort of tactical environment. We have also committed ourselves through the White Paper to have discussions with the United States about ballistic missile defence, which would protect population centres and the like so...

TONY EASTLEY: Okay...

STEPHEN SMITH: ..ongoing cooperation.

TONY EASTLEY: Do you accept that a ballistic missile threat that you talk about, it is a strategic regional perspective. I am asking you here, you mentioned North Korea, would China be concerned about this new alliance between Australia and the US?

STEPHEN SMITH: No. What we've done today with our talks in AUSMIN - whether it has been about the United States global force posture review, whether it is about cyber cooperation or space and space awareness cooperation - is essentially ongoing work that we have been doing with the United States for some time.

TONY EASTLEY: So it is not new missile defence. You're just saying it is an upgraded arrangement, are you?

STEPHEN SMITH: We're doing ongoing work in all of those areas. In cyber cooperation we have announced today that we regard that as being potentially an area which could invoke the treaty and...

TONY EASTLEY: And where is the threat there, Minister? Is that because there has been a lot of talk about China pushing into this area regularly?

STEPHEN SMITH: We don't identify particular nation or nations and we also know with cyber, this is an issue not just so far as nation states are concerned but also non-state actors and it is an issue not just for governments and securities, it is an issue also for industry and commerce.

TONY EASTLEY: But you'd have to identify the threat in order to counter that threat, wouldn't you?

STEPHEN SMITH: Well, we don't publicly indicate from where or from whom we believe cyber attacks come. What we do know is that a country like Australia is at risk just as every other country is at risk - and businesses and commerce in Australia is at risk just as businesses internationally are at risk. So part of our effort here is also to education our own business and our own community and our own population that whilst cyber, use of cyber is a terrific thing, use of internet and the like is a terrific thing, it can also see you lose access to your information very quickly and for a business, particularly in the intellectual property area, that can be very much to your cost.

TONY EASTLEY: Stephen Smith, if I could take you to Afghanistan because it has been in the news this week. We saw in central Kabul this week Taliban gunmen firing at will and setting off explosions. Is everything on track in Afghanistan as far as you're concerned?

STEPHEN SMITH: Well, obviously we spoke about Afghanistan and the international community's commitment to transition by 2014.

Both the United States and Australia believe that we are on track to effect that. I have been saying for some time that we had to expect in the course of this fighting season that because we'd put the Taliban under pressure - not just in Oruzgan where we are but generally - we had to expect that they would come back with these high profile propaganda-style attacks and they've done that.

That is in part because they haven't been able to come back in a broad base way on the ground, whether it is in Oruzgan or elsewhere.

So those examples plus the fact that we know that the very preliminary signs of outreach for political discussion and political rapprochement are there, are in some respects the best evidence that we have made security ground up in Afghanistan and we are putting the Taliban under pressure.

TONY EASTLEY: Defence Minister Stephen Smith, thanks for joining us this morning on AM.

STEPHEN SMITH: Thanks Tony. Thanks very much.



Solutions : www.xcyss.in

Cyber Security and the UK's Critical National Infrastructure

Chatham House Report

• Government cannot provide all the answers and guarantee national cyber security in all respects for all stakeholders. As a result, Critical National Infrastructure enterprises should seek to take on greater responsibilities and instil greater awareness across their organizations
   
• All organizations should look in more depth at their dependencies and vulnerabilities. Awareness and understanding of cyberspace should be 'normalised' and incorporated and embedded into standard management and business practices within and across government and the public and private sectors
   
• Cyber terminology should be clear and language proportionate to the threat. It should also encourage a clear distinction to be made between IT mishaps and genuine cyber attacks
   
• Research and investment in cyber security are essential to meeting and responding to the threat in a timely fashion. However, cyber security/protection should not be the preserve of IT departments but of senior executive boards, strategists and business leaders and it should be incorporated into all levels of an organization. 

Detail paper at :http://www.chathamhouse.org/sites/default/files/public/Research/International%20Security/r0911cyber.pdf

 

Solutions : www.xcyss.in

Bern toughens laws against cyber crime

Switzerland will be a better partner in fighting cyber crime worldwide as of next year.

The Federal Council says modifications in the law will come into force in 2012.

Among the changes are faster exchange of information with other countries, sanctions for putting online any program or information facilitating hacking, and a 24/7 hotline run by the Federal Police.

These changes in the law will make it possible for Switzerland to apply the European Council’s convention on cyber crime.

It is the first international treaty aimed at fighting cyber crime.

Solutions : www.xcyss.in  

Congress Could Make Facebooking at Work a Felony

REBECCA GREENFIELDSEP 15, 2011

"Imagine that President Obama could order the arrest of anyone who broke a promise on the Internet." That's what The Wall Street Journal's Orin Kerrthinks the latest cyber-security legislation will lead to: An assault on checking Facebook at work. Today the Senate Judiciary Committee will vote on proposed changes to the Computer Fraud and Abuse Act, which would seek tougher sentences for digital offenses. As more of the world moves online, so has crime. And legislation needs to adapt. But, does the latest updates to the bill target the right cyber criminals?

No, regular folk are in danger. The way the law is worded, it makes violating a terms of service agreement a felony. "The problem is that a lot of routine computer use can exceed 'authorized access,'" explains Kerr. That means that if your employer prohibits Facebooking on the job and you sneak a peak at a tagged photo, you could face penalties. Senators Patrick Patrick Leahy and Al Franken expressed similar concerns about the proposal, suggesting the administration may be expanding the definition too much, reports eWeek. "We want you to concentrate on the real cyber-crimes, and not the minor things." 

While you might think an employer would never charge an employee for a felony based on Internet wandering, it's not unprecedented, as Kerr points out. "In 2009, the Justice Department prosecuted a woman for violating the 'terms of service' of the social networking site MySpace.com. The woman had been part of a group that set up a MySpace profile using a fake picture. The feds charged her with conspiracy to violate the Computer Fraud and Abuse Act." He also cites a case where a woman faced charges for using Ticketmaster. Abuse of the language of the legislation is a real possibility.

But, what about hackers? The legislation isn't meant to target these petty insances, it's to deal with the ever growing hacking threats that businesses and our government face. "Online criminals organize in networks, often with defined roles for participants, in order to manage and perpetuate ongoing criminal enterprises dedicated to stealing commercial data and selling it for profit," Secret Service Deputy Special Agent in Charge Pablo Martinez said regarding the act, reports The Hill. The law is really meant to crack down on organized Internet crime, which is a real threat that most businesses and the government aren't prepared for, as a recent PricewaterhouseCoopers survey found, reports Bits Blog. When asked about cyber security precautions, most were unprepared. "It turned out that only 13 percent of those surveyed had actually done what the consulting firm considered to be adequate--meaning they had an overall security strategy, they had reviewed the effectiveness of their strategy and they knew precisely the types of breaches that had already hit them over the last 12 months."

Anyhow, the bill might not have that much enforcement power. Kerr overestimates the power of the act. "The White House plan does not include any criminal or civil provisions for forcing companies to comply with Department of Homeland Security cyber security standards," continues The Hill. "The idea was to create a lighter touch ... to build incentives into the system," Associate Deputy Attorney General James Baker said. Meaning, many businesses wont bother to enforce--for better or worse. 

Solutions : www.xcyss.in

Damballa Threat Report – First Half 2011 (Extract)

Introduction


The first half of 2011 picks up where 2010 left off – it looks to be another big year for Internet crime with botnets and targeted attacks becoming headline news on an almost weekly basis. This brief report looks at some of the trends identified by Damballa Labs over the first six months of 2011, specifically the threats most
regularly encountered and damaging to home users and poorly secured businesses.
Much of this report focuses on botnets and botnet operators. A ‘botnet’ can be defined as a network of
infected assets (victim machines) under the remote control of certain criminal botnet operator(s). These
operators utilize a specific array of command-and-control (C&C) servers to receive the stolen information and issue malicious instructions to the infected assets. There are often multiple infections per victim as their
computer is repeatedly compromised through various criminal campaigns and is subsequently remotely
managed by different operators. A specific (in this case ‘named’) botnet is often associated with a certain type
or class of malware and has certain characteristics regarding how it communicates, the command-and-control
servers used, traffic patterns, etc.

Nearly all the malware associated with these botnets is ‘multi-purpose,’ meaning the malware is capable of
obtaining full administrative and remote control over applications on the victim machine. The malware families
used by criminals for fraud and online crime are often referred to as crimeware. At the direction of the bot
operator, crimeware allows the operator to achieve any number of criminal objectives including credential
stealing, key logging, opening backdoors to an enterprise network, and user impersonation on the victim
machine to conduct fraudulent transactions and gain access to critical business application data. The
crimeware component is frequently upgraded or repurposed and, once an asset is infected, access to the
victim machine can be ‘rented’ or sold to other criminal operators for a nominal fee. In fact, for the first half of
2011, more than 40% of infected assets were actively communicating with two or more botnet operators.

This report:

•  Reveals The Top 10 Largest Botnets in the first half of 2011
•  Discusses operator and malware trends
•  Identifies the Top 10 Most Abused TLDs (top level domains)
•  Provides a first-ever assessment of mobile malware C&C activity

Solutions : www.xcyss.in    

How mobile malware actually grew by 1400 percent in the last 12 months

by Davey Winder on Sep 14th, 2011


Mobile phone security threats used to be mocked by everyone outside of vendors with mobile antivirus software to sell. That has changed, and how. The online media headlines have been full to bursting with reports that 'mobile malware' had grown by a staggering 273 percent in the first half of 2011 when compared to the same period for the year before. But can that be true? The answer, it would seem, is no. It's actually much, much worse. Maybe.

The news broke on the back of a report from German-based security software specialistsG Data which issued a press release detailing that 273 percent figure. But according to a sharp-eyed reporter for Mobile Europe all is not quite as it seems. While the press release highlighted précis of the report, which is what most news outlets appear to have looked at and used to produce not only their headlines but also the meat of the story, states that mobile malware overall had risen by 273 percent the actual report shows that this figure relates to the share of the overall malware market represented by mobile platforms.

As the Mobile Europe reporter states, taking the sequential half year numbers quoted in the G Data report: "mobile malware has increased around 1,400 percent from 55 to 803 detected threats". So why the 'maybe' in my opening paragraph? Well, simply put, although the 1,400 percent rise figure looks really very scary indeed on paper, out here in the real world of cyber-crime the impact of mobile malware remains fairly low. Taken as a share of the overall malware threat landscape, mobile malware accounts for just 0.1 percent and that's after the 1,400 percent rise!

David Harley, senior research fellow at another security software vendor, ESET, still thinks mobile users should be worried though. "The idea of a single device as a single storage repository has given way to a much more distributed model" he says, concluding "your data reside in the cloud and mobile devices are as much a form of handheld smart terminal as application servers in their own right. Think of your phone as a key to your data-safe, not just as a phone with games and a bit of web browsing, and you'll realise you need to secure both the safe and the key". When the bad guys discover how to monetise the ability to infect those smart-terminals with malware, then I would imagine that 1,400 percent figure will seem on the low side as one thing in this whole mis-reported mess can be read as gospel: cyber-criminals will surely follow the money.

Solutions : www.xcyss.in   

Heidi Klum Replaces Cameron Diaz as Web's Most Dangerous Celebrity

---

September 16, 2011 07:52:49 GMT

Heidi Klum is apparently one dangerous celebrity. The former Victoria's Secret model has topped Internet security firm McAfee's annual list of Most Dangerous Celebrity in Cyberspace. She takes over the title from last year's No. 1 celebrity Cameron Diaz, who slipped to the runner-up position.

In a press release, McAfee claimed that fans are at risk of running into online threats designed to steal personal information. Research found that searching for the "Project Runway" host's pictures and downloads "yields more than a 9% chance of landing on a website that has tested positive for online threats, such as spyware, adware, spam, phishing, viruses and other malware."

CNN talk show host Piers Morgan and two Hollywood beauties Jessica Biel and Katherine Heigl rounded up the Top 5 most dangerous list. Tennis star Maria Sharapova dropped from No. 13 to No. 44, pop sensation Justin Bieber came in at No. 49, while "Born This Way" hitmaker Lady GaGa landed at No. 58.

Paula Greve, director of Web security research at McAfee, additionally reminded, "While slightly safer than last year, searching for top celebrities continues to generate risky results. Consumers should be particularly aware of malicious content hiding in 'tiny' places like shortened URLs that can spread virally in social networking sites or through e-mails and text messages from friends."

Top 10 Most Dangerous Celebrities in Cyberspace:

1. Heidi Klum
2. Cameron Diaz
3. Piers Morgan
4. Jessica Biel
5. Katherine Heigl
6. Mila Kunis
7. Anna Paquin
8. Adriana Lima
9. Scarlett Johansson
10. Emma Stone, Brad Pitt and Rachel McAdams

Solutions : www.xcyss.in