Mountain View, California: the latest from SINET ITSEF 2016
SINET IT Security Entrepreneurs Forum (ITSEF) 2016: "Bridging the Gap Between Silicon Valley and the Beltway" (SINET) IT Security Entrepreneurs Forum (ITSEF) — SINET's flagship event — is designed to bridge the gap between the Federal Government and private industry. ITSEF provides a venue where entrepreneurs can meet and interact directly with leaders of government, business and the investment community in an open, collaborative environment focused on addressing the Cybersecurity challenge
Closing Thoughts on SINET ITSEF 2016: Managing Risk, Making it Easy on Your Customers (The CyberWire) We offer some quick notes and reflections on the closing sessions of SINET’s ITSET 2016. The panels and presentations we describe today will, we believe, be of interest to the entrepreneur
Cyber Attacks, Threats, and Vulnerabilities
MongoDB configuration error exposed 93 million Mexican voter records (CSO) According to Mexican law, it's illegal to use voter records for personal gain
Databases Remain Soft Underbelly Of Cybersecurity (Dark Reading) Most enterprises still don't continuously monitor database activity
“Nuclear” exploit kit service cashes in on demand from cryptoransomware rings (Ars Technica) Exploit kit's inner workings exposed as researchers help shut down its servers
JIGSAW Takes Crypto-Ransomware in Deadly Directions (IBM Security Intelligence) Horror films are being leveraged by the crypto-ransomware pushers in pursuit of your money. One ransomware strain, JIGSAW, uses the characters from the film “Saw” to instill fear into its victims
CryptXXX ransomware steals bitcoins and data from infected PCs (Graham Cluley) Ransomware asks for $500, and steadily increases its demands over time
A Brief History Of Ransomware (Dark Reading) A top ten chronicle of more than a decade of notable ransomware variants and trends
New point-of-sale malware Multigrain steals card data over DNS (IDG via CSO) The malware was designed for stealth operation inside restricted PoS environments
PoS Attacks Net Crooks 20 Million Stolen Bank Cards (Threatpost) In a storyline that rivals an episode of The Sopranos, researchers at FireEye documented the heist of bank card data from 20 million individuals that involved a complex web of crooks that may have netted hackers more than $100 million since 2014
How Hackers Have Honed Their Attacks (Dark Reading) More organizations are getting breached, but data exfiltration is becoming harder for attackers, new data shows
SIM-Swap Fraud: Dont be a Victim! (Check & Secure) While many of us regularly use mobile devices for banking, most of us (60-80%) remain suspicious and do little more than check our balance using mobile devices
Critical Infrastructure Vulnerable to Attack, NSA Leader Says (US Department of Defense) Strong dependence on industrial control systems, or ICS, is a serious vulnerability for industry, the National Security Agency’s deputy director said here yesterday
Giant Food Sees Giant Card Fraud Spike (KrebsOnSecurity) Citing a recent and large increase in credit card fraud, Washington, DC-area grocer Giant Food says it will no longer allow customers to use credit cards when purchasing gift cards and reloadable or prepaid debit cards
Security Patches, Mitigations, and Software Updates
Cisco fixes serious denial-of-service flaws in wireless LAN controllers, other products (CSO) One of the vulnerabilities is critical and the rest are rated as high severity
Oracle releases 136 security patches for wide range of products (IDG via CSO) The company has adopted the new CVSS 3.0 vulnerability rating system, resulting in a larger number of flaws rated as high and critical
29% of Android devices can’t be patched by Google (Naked Security) Google on Tuesday released the second annual security report on its “toxic hellstew of vulnerabilities,” or what the rest of us know as Android
Cyber Trends
Is It Time to Rethink Cyber-Security Strategies? (Baseline) Despite the efforts devoted to thwarting cyber-attacks, the threats keep growing, and many question whether conventional methods are enough to protect a company
5 Reasons Cybercriminals Target Healthcare (Dark Reading) Cybercriminals are increasingly targeting healthcare institutions and successfully deploying malware and ransomware to exploit hospitals' need to recover quickly
Marketplace
As Pentagon Dawdles, Silicon Valley Sells Its Newest Tech Abroad (Defense One) A trio of tech CEOs say red tape and onerous requirements are undermining Ash Carter’s outreach efforts
SecureWorks Prices IPO Of 8 Mln Class A Common Stock At $14 A Share (RTT News) SecureWorks Corp. (SCWX), a provider of intelligence-driven information security solutions, announced late Thursday the pricing of its initial public offering of 8 million shares of its Class A common stock at a price to the public of $14 per share
Cyber Security Company SecureWorks Prices Year's First Tech IPO (Fortune) The computer security company is the first tech IPO of 2016
Palo Alto: Under Appreciated Free Cash Creates Opportunity (Benzinga) Palo Alto Networks Inc (PANW) shares have lost 8 percent since March 22. Morgan Stanley’s Keith Weiss maintained an Overweight rating for the company, while raising the price target from $171 to $185. The analyst mentioned that a 40 percent 3-year FCF CAGR made Palo Alto a Top Pick among Security stocks
Unisys CEO: Security Sales Set To Soar As Cybsecurity Software Is Taken Global (CRN) Unisys plans to double down on security-oriented consulting, infrastructure and managed services, and to extend its Stealth cybersecurity offering to vertical practices around the planet
Check Point chugs on: Profits and revenues up despite volatile market (Register) CEO warns that he's 'cautious as regards overall IT industry spending'
Proofpoint Inc (PFPT) Issues FY16 Earnings Guidance (Más) Proofpoint Inc (NASDAQ:PFPT) issued an update on its FY16 earnings guidance on Thursday morning. The company provided EPS guidance of ($0.15)-(0.13) for the period, compared to the Thomson Reuters consensus EPS estimate of ($0.23), Marketbeat.com reports. The company issued revenue guidance of $350.5-353.5 million, compared to the consensus revenue estimate of $347.79 million.Proofpoint also updated its Q2 guidance to ($0.08)-(0.07) EPS
Cybersecurity startup formerly known as ThreatStream raises $30M (Silicon Valley Business Journal) Cybersecurity software startup Anomali, formerly known as Threatstream, raised $30 million on Thursday to expand internationally
CORRECTION - Bugcrowd Raises $15 Million to Bring Its Bug Bounty Security Platform to More Companies Around the Globe (Marketwired) In the news release, "Bugcrowd Raises $15 Million to Bring Its Bug Bounty Security Platform to More Companies Around the Globe," issued yesterday, April 20th, 2016, by Bugcrowd, we are advised by the company that the fifth paragraph has been amended
Intel's CEO Can't Seem To Shake John McAfee's Name (Forbes) In a presentation he delivered at the popular CES show in January 2014, Intel CEO Brian Krzanich said the chip giant would be eliminating the McAfee name from its security business and rebranding to Intel Security
Cyphort Named a Leader by Independent Research Firm in Automated Malware Analysis Report (BusinessWire) Cyphort cited for approaching analysis differently in both messaging and technology
SecureAuth Opens Federal Headquarters in Dulles Technology Corridor (MarketWired) SecureAuth Corporation, the leader in adaptive access control, today announced the official opening of its Reston, Virginia office. The office, strategically located in the Dulles Technology Corridor, will function as SecureAuth's federal headquarters and base for east coast members of the company's sales, marketing, pre-sales, customer development, support and professional services teams
Products, Services, and Solutions
Quick Assessment With Recorded Future Malware Intel Cards (Recorded Future) Staying on top of new malware families and variants is critical intelligence for many threat teams
Versasec Unveils vSEC:CMS 4.4 Smart Card Lifecycle (Verasec) New version of smart card management system focuses on performance, verifiable results
CyberX and Check Point Partner to Secure Industrial Networks (PRNewswire) CyberX, the pioneering provider of security solutions for industrial networks and Check Point® Software Technologies (NASDAQ: CHKP), have partnered to secure mission critical networks in the industrial arena. The joint offering delivers a high-level of protection with a proactive security solution ensuring industrial networks security
How a Secret Strategy Helps BlackBerry and Microsoft Solve Government’s Mobile Problem (IT Business Edge) Every once in a while, I run into something amazing. In this case, it is an effort announced at the AFCEA Defensive Cyber Operations Symposium that should ensure that BlackBerry and Microsoft dominate government and high-security enterprise mobile solutions, an effort that is not actually driven by Microsoft or BlackBerry
Future of anti-virus is pay-as-you-use (ITWeb) Pay-as-you-use Internet protection – the vision behind Panda Protection Service. "This 2016 product launch is just the tip of the iceberg," says Rado Svicin, VP of Consumer Business at Panda Security. Flexible and affordable protection the main aim
Technologies, Techniques, and Standards
Chip card payment confusion, anger rages on (CSO) Merchants blame card companies for delays in certifying EMV software
How Best To Back Up Your Data In Case Of A Ransomware Attack (Dark Reading) A ransomware attack could be around the corner, but there are some practical steps you can take to back up your data and deflect the attack
Speed is Key to Threat Intelligence Sharing at Every Level (MeriTalk) Speed and communication are key elements to effective threat intelligence in the government, according to panelists at the Akamai Government Forum on Thursday
Misunderstanding Indicators of Compromise (Threatpost) Reports of APT activities detail compromises spanning multiple organizations, sectors, industry verticals, and countries (over multiple years)
IDF's IT unit head: 'Our enemy understood it can try to shut us down with a cyber attack' (Jerusalem Post) Driven by rising enemy capabilities to launch cyber attacks that could paralyze IDF operations, the military unit in charge of IT infrastructure held a large-scale cyber war drill on Thursday, testing its ability to switch to shadow facilities in the event of a shut down
Security Lessons from C-3PO, Former CSO of the Millennium Falcon (Dark Reading) The business will take risks. When and how to speak up
Design and Innovation
Convergence Of Operational Risk And Cyber-Risk management in FS21 (FinExtra) Recent reports confirm the trend towards ever more serious cyber-security breaches (“90 percent of large companies have suffered a data breach over the last year, compared to 81 percent last year” PwC report – link)”, “Nearly half the population of the United States has been affected by breaches of protected health information (PHI) over the past 10+ years (Verizon Report – link). On a similar upward curve are the number of papers, methods and tools which offer of advice and guidance on risk management and regulatory compliance monitoring
Mea Culpa: Time To Build Security Into Connectivity (Dark Reading) How those of us who spent decades developing faster, easier, and more scalable networking technology have made the lives of our security counterparts a living hell
Academia
University of Oregon: cybersecurity looks for students to counter the dark art of hacking (Register-Guard) The University of Oregon is bringing top cybersecurity experts to campus Friday for its sixth annual Oregon Cyber Security Day — and the event couldn’t be more timely
UC Recognized as a Leader in Cybersecurity Education (University of Cincinnati) UC's School of Information Technology has been designated a National Center of Academic Excellence in Cyber Defense Education
Illinois State meets growing need for cybersecurity professionals (Illinois State University) It’s a great time to be a cybersecurity professional.
Augusta needs to embrace cyber growth, AU president says (Augusta Chronicle) The relocation of the U.S. Army Cyber Command to Fort Gordon will create spinoff companies and jobs, but Augusta has to be ready to take advantage of that, Augusta University President Brooks Keel told the Augusta West Rotary Club on Thursday
Legislation, Policy, and Regulation
Why One Cybersecurity Firm Says China Has Soured on Conventional Hacking (Wall Street Journal) One of the most surprising recent moments in U.S.-China relations arrived last September in Washington D.C. when Barack Obama and Chinese President Xi Jinping told reporters they’d reached a deal to end state-supported hacking of corporate records for economic benefit
Fmr. NSA Director: U.S. Needs Security, Privacy (Fox Business) Top military and industry leaders convened at a cyber-summit at West Point, New York Thursday to discuss the latest advancements and struggles in America's fight against cyber terrorism
Lawmakers Want Updates on Pentagon’s Security Clearance Overhaul (Nextgov) House lawmakers want quarterly updates as the Defense Department builds a new state-of-the-art system to store sensitive background investigation forms on national security employees and contractors
Government CIOs Lean Toward Cloud for Security (MeriTalk) Cloud computing offers the most security for government data, argued Homeland Security CIO of U.S. Citizenship and Immigration Services Mark Schwartz, at the Akamai Government Forum on Thursday
DOD wants to stop playing 'whack-a-mole' on cyber (Defense Systems) The Defense Department is looking to get more proactive in defending its information network, rather than simply responding to attacks
Litigation, Investigation, and Law Enforcement
Philippines Cyber Cops Arrest "White Hat" Hacker Suspected of Exposing 55 Million Voters' Details (International Business Times) Law enforcement in the Philippines claim to have arrested one of the hackers involved with the breach of the country's Commission on Elections (Comelec). The National Bureau of Investigation (NBI), which is tasked with investigating the massive cyberattack that compromised millions of electoral records last month, has now announced the arrest of a man in his early twenties in relation to the hack
Philippine voter data hacked but polls to go ahead (AP via News & Observer) The hacking of a Philippine election database may have exposed the personal information of all 55 million registered voters, but will not undermine May 9 national elections, officials said Friday, in the latest hacking scandal to hit the Southeast Asian nation
FBI paid at least $1.3M for zero-day to get into San Bernardino iPhone (Ars Technica) FBI Director James Comey: "But it was, in my view, worth it"
The Cell Phone-Monitoring Agency You've Never Heard Of (Nextgov) A federal agency dedicated to monitoring cellular network traffic was watching last December as calls flooded San Bernardino 911 dispatchers. Nope, not the National Security Agency or the Federal Communications Commission. It was the National Coordinating Center for Communications, an obscure part of the Homeland Security Department
National Security Letters are now constitutional, judge rules (Ars Technica) The law's change "cures the deficiencies previously identified by this Court"
Judge tosses evidence obtained by FBI malware planted on dark website (Naked Security) A US federal judge has thrown out evidence in a child abuse imagery case obtained by the FBI’s use of a hacking tool
SEC Brings Enforcement Action Against a Broker-Dealer for Weak Cybersecurity Controls (JDSupra) On April 12, 2016, the U.S. Securities and Exchange Commission (“SEC”) continued its enforcement of reasonable cybersecurity controls, announcing cease and desist proceedings against a broker-dealer and two of its principals under Regulation S-P for its “failure to adopt written policies and procedures reasonably designed to ensure the security and confidentiality of customer records and information.” The SEC also found the broker-dealer in violation of Section 17(a) of the Exchange Act and Rule 17a-4 thereunder for failing to “make and keep certain communication relating to its business.” Although there was no allegation that any client suffered financial harm, the broker-dealer settled for $100,000, while the principals settled for $25,000 each
SpyEye Makers Get 24 Years in Prison (KrebsOnSecurity) Two hackers convicted of making and selling the infamous SpyEye botnet creation kit were sentenced in Georgia today to a combined 24 years in prison for helping to infect hundreds of thousands of computers with malware and stealing millions from unsuspecting victims
Brazen no more, makers of account-draining bank trojan get 24 years (Ars Technica) SpyEye infected more than 50 million PCs and caused almost $1 billion in losses
Hospital will pay $2.2M for letting Dr. Oz show film w/o consent, air death (Ars Technica) Deceased’s family learned of footage by inadvertently watching it on TV
