Volume LIII, Issue 5

Posted on by dciadminwp

In This Issue

FBI Director Sees Increasing Interest in Cyber-Attacks

Excerpted from Wall St. Journal Report by Damian Paletta

Federal Bureau of Investigation (FBI) Director James Comey said Wednesday that terrorist groups had begun discussing ways to hit Americans with a cyber-attack, though he said plotting appeared to be in early stages.

“We are picking up signs of increasing interest,” he said in evening remarks at the Aspen Security Forum. “It’s a small but potentially growing problem.”

Comey didn’t divulge what sort of cyber-attack terrorist groups could be trying to design. US officials have spent years trying to protect things like water-treatment plants, electrical grids, and the banking system from debilitating cyber-attacks, but they remain wary because criminal gangs and sophisticated nation-state hackers have proven adept at breaking through networks.

He said a cyber-attack against Americans had become a popular strategy for some terrorist groups that had found it difficult to infiltrate or recruit followers in the US.

Comey’s comments came as part of a wide-ranging discussion at the Aspen conference, a yearly gathering of government and industry officials and academics. The FBI director touched on encrypted messaging technology and threats posed by ISIS… Read More

Are Current Cybersecurity Measures Enough?

Excerpted from Slate Report by Lily Hay Newman

With all the high-profile hacks being disclosed lately, it certainly seems like both public and private cybersecurity protections are lacking.

But two surveys of security professionals reveal widely varied views on whether companies and networks are prepared to deal with digital attacks.

In the “Critical Infrastructure Readiness Report” from McAfee, the Aspen Institute, and Intel, almost 75 percent of the 625 respondents said they were confident or extremely confident in their organization’s framework for identifying intrusions.

Sixty-eight percent said they were confident that they could deal with attacks. Sounds great, let’s all go home.

Seventy percent of the same survey respondents, though, said that there were more and more threats out there.

And a vast majority reported at least one cyber-attack on their organization’s system, with the median number of attacks at 20 per year.

Respondents said that these hacks resulted in service interruptions, data breaches, and even physical damage… Read More

Challenges Face Computer Security Incident Response Teams

Excerpted from Council on Foreign Relations Report by Tim Maurer

In mid-June, the German parliament scrambled to repel the worst cyber-attack in its history.

Meanwhile, 800 IT security experts and members of Computer Security Incident Response Teams (CSIRTs) from around the world met just a few blocks away at the annual meeting of the Forum for Incident Response and Security Teams (FIRST).

Responding to attacks like the one against the Bundestag is at the core of a CSIRT’s daily tasks.

As cybersecurity has become a core strategic interest for companies and governments alike, there is a growing need to safeguard CSIRTs’ operational independence from other political objectives and strengthen them as a neutral pillar of global cybersecurity.

CSIRTs have been a cornerstone of cyber incident response for decades. Also known as Computer Emergency Response Teams (CERTs), CSIRTs are teams of technical experts with the mission to maintain and protect the security of their customers’ computer networks and systems that rely on it.

The OpenSSL Heartbleeed vulnerability was discovered last year, which security expert Bruce Schneier called a catastrophic bug… Read More

Report from DCIA CEO Marty Lafferty

Click Here for Video

The DCIA encourages you to contact your US Senator and urge him or her to press for a vote on cybersecurity legislation before Congress begins its August recess.

The Cybersecurity Information Sharing Act (CISA) is a carefully drafted and well-intended measure to support the sharing of critical data regarding cyber-attacks between government and industry.

Its two companion pieces of legislation have both already passed — and by wide margins — in the House of Representatives.

In our view, the passage of CISA will mark an important and necessary step forward in improving the cybersecurity of the United States.

The bill enjoys strong bipartisan support among lawmakers and in the White House.

Over the weekend, Senate Majority Leader Mitch McConnell (R-KY) confirmed that Republicans want to advance the measure before their break, and that “cybersecurity issues are enormously significant.”

Senate Majority Whip John Cornyn (R-TX) targeted the first week of August as the timetable to bring CISA to a vote.

Reducing the liabilities and other legal barriers that discourage information sharing related to cyber-threats, among public and private sector organizations, is timely and essential.

Increased knowledge will clearly enhance the ability of companies, agencies, and individuals to defend themselves against hacks and more serious dangers.

We appreciate the concerns of privacy advocates, but are confident that CISA will be able to achieve its objectives without compromising the data of individual consumers.

In this instance, the potential harm to all constituents would be far greater than the risk of not having this enabling legislation.

So please, contact your Senator. Share wisely, and take care.

Worried About Cyber-Apocalypse? AIG Has Policy

Excerpted from Bloomberg News Report by Sonali Basak

A three-hour shutdown of the New York Stock Exchange on the same day that a network failure halted all United Airlines flights in the US had people across the country thinking one thing: cyber-attack.

It wasn’t, but the July 8th incidents were alarmingly close to the Armageddon scenario that Austin Berglas, a former Federal Bureau of Investigation (FBI) agent, described in an interview last month, in which the Nasdaq exchange, the New York subway system, and power provider Con Edison go offline at the same time.

Berglas, who started the FBI’s New York cyber-crime unit in 2009 and worked on probes into a breach at JPMorgan Chase and the Silk Road drug market, joined corporate investigations company K2 Intelligence in April.

The firm is partly owned by American International Group (AIG) which is seeking to sell insurance policies for property and infrastructure damage caused by hackers and cyber-terrorists.

“There’s going to be mass panic, people are going to think it’s a terrorist attack, people are going to think it’s another 9/11 event,” Berglas said.

“You’re not only dealing with a cyber-incident, but now you have to get folks stranded in a subway in the middle of tubes… Read More

Web Is Moving towards Multi-DRM World

Excerpted from castLabs News Report

The days of plugin technology for video delivery are numbered. Firefox disables the Flash plugin, Microsoft announced the end of Silverlight support, and Chrome is terminating support for all NPAPI-plugins including their own Widevine Classic player.

The entertainment world is moving towards HTML5 with Encrypted Media Extensions (EME) and Common Encryption (CENC).

This allows one common file format for video (MPEG-DASH) which simplifies the content workflow. Video services no longer have to package, store, and deliver different player and DRM-specific file formats like Widevine Classic (.WVM), Smooth Streaming (.PIFF), or Flash (.FLV, .F4V).

But the move towards HTML5 does not only mean a change in content workflow and player technology, but also a shift in DRM technologies.

The Adobe Flash plugin uses Adobe Access DRM (part of Adobe Primetime) for the protection of premium content in all browsers and Silverlight is using PlayReady DRM in all browsers. However, when moving to premium video delivery in HTML5… Read More

New Approach to IoT Security Addresses IT & OT

Excerpted from Network World Report by Zeus Kerravala

The concept of the Industrial “Internet of Things” (IoT) is still a bit of an enigma for most organizations, but it is certainly of high interest. I’ve been presenting on this topic at the IT Roadmap events and the sessions have been packed. If you find yourself in New York on July 29th, stop by the Javits and see the session.

One of the challenges that businesses face with the IoT is how to bring information technology (IT) and operational technology (OT) together. If you’re unfamiliar with IT versus OT, IT is, of course, corporate IT, the group to which most of the readers of this site belong.

OT is responsible for the technologies that deal with operating the business and generating revenue. This is a very broad range of items and is normally vertical in nature: trucks in field service, medical equipment in healthcare, factory floor hardware in manufacturing, etc.

In an IoT world, everything gets connected to a common network. This means water pumps, heart monitors, conveyor belts, and heavy machinery will be connected to the same network that supports printers, PCs, and corporate servers. There is a little bit of overlap in these two worlds, as some manufacturers make infrastructure to be used in industrial environments… Read More

Microsoft Buys Israeli Cloud Security Firm for $320M

Excerpted from CIO Today Report by Shirley Siluk

An Israeli start-up focused on cloud application security is reportedly the next addition to Microsoft ever-expanding stable of acquisitions.

Adallom, which is headquartered in Palo Alto, CA and has a research-and-development (R&D) facility based in Tel Aviv, has been acquired by Microsoft for $320 million in cash, according to news reports.

If confirmed, the acquisition — reported by Israeli financial publications Globes and The Calcalist — would be Microsoft’s largest to date in Israel.

However, it’s hardly the first: in just the past nine months Redmond has purchased three other Israeli tech firms.

Founded in 2012 with $4.5 million in Series A funding led by Sequoia Capital, Adallom is led by three veterans of the Israeli Intelligence Corps: co-founders Assaf Rappaport, who is CEO; Ami Luttwak, CTO; and Roy Reznik, Vice President of R&D.

The company’s technology provides security for enterprises that use cloud-based, software-as-a-service (SaaS) applications for CRM , ERP, collaboration, storage, and other tasks. We reached out to Microsoft and Adallom for confirmation of the pending acquisition… Read More

US Lawmakers Look to Protect Dot-Gov Domain

Excerpted from Reuters Report by Patricia Zengerle

Republican and Democratic US Senators introduced legislation on Wednesday to give the Department of Homeland Security (DHS) more authority to protect government Internet addresses, hoping to prevent more cyber-attacks like recent massive breaches at the government’s hiring office.

Katherine Archuleta, the chief of the Office of Personnel Management (OPM), resigned earlier this month after the computer hacks, possibly linked to China, put the personal data of some 21.5 million Americans at risk. The attacks prompted calls in Congress for huge improvements in monitoring and protection of government systems.

“This cyber-attack points to a broader problem,” said Republican Senator Susan Collins, one of the bill’s lead sponsors.

Among other things, the legislation would give the DHS the authority to monitor all federal agencies in the “dot-gov” Internet domain, and operate defensive countermeasures. Currently, each agency monitors its own networks and then requests help from the DHS if it feels it needs it.

The measure also would direct the DHS to conduct risk assessments of any network within the government domain.

Sponsors of the bill include Collins and fellow Republican Senators Dan Coats and Kelly Ayotte, as well as Democratic Senator Mark Warner… Read More

Cyber-Hijacking: Hackers Take Wheel from Drivers Remotely

Excerpted from Dallas Morning News Report by Craig Timberg

As the number of connected devices explodes — from roughly 2 billion in 2010 to an estimated 25 billion by 2020 — security researchers have repeatedly shown that most online devices can be hacked.

Widespread hacks on cars and other connected devices are destined to come, experts say, as they already have to nearly everything else online. It’s just a question of when the right hacking skills end up in the hands of people with the sufficient motives.

“If you’ve learned anything from the Internet, it’s clearly going to happen,” said Kathleen Fisher, a Tufts University computer-science professor and security researcher.

The inherent insecurity of the Internet — an ungoverned global network running on technology created several decades ago — makes it difficult to add effective safety measures now. Yesterday’s flaws, experts say, are being built directly into tomorrow’s connected world.

Among the most vivid examples came this week, when security researchers Charlie Miller and Chris Valasek demonstrated that they could hijack a vehicle over the Internet. By hacking into a 2014 Jeep Cherokee, the researchers were able to turn the steering wheel… Read More

Government Push to Regulate Driverless Cars Begins

Excerpted from Washington Post Report by Brian Fung

The more we learn about driverless and Internet-connected cars, the more we’re learning to fear them. Between reports of test-drive accidents, however minor, and hackings on actual highways, new automotive technology is sparking a fresh push by national governments to regulate these next-generation vehicles.

This week in particular has seen a flurry of new federal action to protect drivers on the road. On Tuesday, Sens. Ed Markey (D-MA) and Richard Blumenthal (D-CT) unveiled a bill aimed at keeping Web-enabled cars from getting hacked.

“Rushing to roll out the next big thing, automakers have left cars unlocked to hackers and data-trackers,” said Blumenthal. “This common-sense legislation protects the public against cyber-criminals who exploit exciting advances in technology.”

The bill, called the SPY Car Act, would require certain commitments from car manufacturers who want to build driverless or connected cars. For example, under the legislation the Federal Trade Commission (FTC) would force automakers to use “reasonable measures” to protect the increasingly complex software that helps our cars run smoothly. Together with highway authorities, the FTC would also develop a window sticker that rates a new car’s vulnerability to digital attack, in the same way consumers use fuel economy stickers to evaluate a car’s potential gas mileage… Read More

Healthcare Organizations: Victims of Data Breaches

Excerpted from Becker’s Health IT & CIO Review by Max Green

Not only have the majority of healthcare organizations been victims of cyber-attacks and security breaches, but the business associates of those organizations also often fall prey to attacks, according to a new report.

Here are 10 key findings to know from the Fifth Annual Benchmark Study on Privacy & Security of Healthcare Data, published by the Ponemon Institute, a data protection and information security policy research center in Traverse City, MI.

When asked what type of security incidents worry them the most, 70 percent of healthcare organizations answered employee negligence. This was followed by hackers at 40 percent and the use of public cloud services at 33 percent.

Healthcare organizations reported the following perceptions of privacy.

Policies and procedures do effectively prevent or quickly detect unauthorized patient data access, loss or theft: 58 percent.

Organization personnel have the technical expertise to be able to identify and resolve data breaches involving unauthorized access, loss or theft of patient data: 53 percent.

Technologies within the organization effectively prevent or quickly detect unauthorized patient data access, loss or theft: 49 percent… Read More

Relief for Cyber-Theft Victims Still Work-in-Progress

Excerpted from Washington Post Report by Joe Davidson

Beth Cobert comes to the Office of Personnel Management (OPM) carrying good will from federal labor leaders developed during her days just a few blocks away at the Office of Management and Budget (OMB).

President Obama sent her to be OPM’s acting director a week ago in the wake of Katherine Archuleta’s hasty departure as HR chief following disclosures that the personal information of more than 21 million federal employees and others was stolen in a massive security breach.

“I want to thank you for saying yes” to the OPM assignment, Colleen M. Kelley, President of the National Treasury Employees Union told Cobert during a National Council on Federal Labor-Management Relations meeting at the OPM building Wednesday morning. At the beginning of the session, Cobert presented a Theodore Roosevelt award to the retiring Kelley in honor of her service.

After the niceties were done, the Council got down to business with pointed questions about ramifications for victims of the cyber-theft. Some Cobert could not answer. Some answers were not what the labor leaders wanted to hear.

The lack of information only deepens the angst, aggravation and anger of the robbed… Read More

Federal Government Needs Cybersecurity Marathon

Excerpted from ABC News Report by Adam Levin

Over the past 16 years, Tony Scott served as the chief information officer (CIO) for both Microsoft and Walt Disney, and from 1999-2005 he was the Chief Technology Officer of Information Systems and Services at General Motors.

Scott was recruited to become the CIO of the US back in February to stop our nation’s cyber-bleeding, specifically at federal agencies like the Office of Personnel Management (OPM), which suffered a monumental breach, the full ramifications of which are still unknown. ABC News reported that the initial intrusion into OPM’s systems likely started before Scott’s appointment.

In an interview with Federal Times, Scott described our nation’s antiquated data security practices in stark terms.

“Most of the systems, most of the technology you and I use every day was designed and architected in the 1970s or 1990s,” he said, noting even newer systems are built on the same framework.

“It’s kind of like trying to put airbags on a ’65 Mustang — it just wasn’t designed for security, wasn’t designed for safety.”

In an effort to jump-start a thorough review of federal systems and hopefully get people thinking, working and most importantly taking the necessary actions to close loopholes, Scott called for something he called a 30-Day Cybersecurity Sprint… Read More

Cloud Giants Establish Container-Focused Industry Group

Excerpted from Top Tech News Report by Shirley Siluk

Enterprises moving applications to container-based clouds will benefit from an industry-wide, open source effort to coordinate tech development, according to founding members of the newly created Cloud Native Computing Foundation (CNCF). Led by the Linux Foundation, the new group includes such companies as Google, CoreOS, Docker, and VMware.

The goal of the new foundation is to “advance the state of the art for building cloud-native applications and services.” Cloud native means those applications and services will support containers, dynamic scheduling and micro services.

The creation of the Cloud Native Computing Foundation comes at the same time that Google has released a production-ready version of its Kubernetes open source container orchestration system. Kubernetes is designed to help enterprises more easily manage clusters of Linux containers as a single system to simplify operations and speed up development.

“By bringing together the open source community’s very best talent and code in a neutral and collaborative forum, the Cloud Native Computing Foundation aims to advance the state of the art of application development at Internet scale,” said Jim Zemlin, Executive Director of the Linux Foundation. Cloud-native application development today enables enterprises to scale their businesses… Read More

Why Verizon, AT&T, Twitter Support This Hot Technology

Excerpted from Fortune Report by Jonathan Vanian

You can tell when a business technology really starts catching on in the mainstream when high profile companies are willing to associate their names with it.

Last month a group of more than 20 heavyweights including Goldman Sachs, Hewlett-Packard, and IBM pledged support to a new foundation focused on creating an industry wide standard around a fast rising data center technology called a container.

On Wednesday, the Open Container Initiative (formerly known as the Open Container Project) said that 14 more companies — including AT&T, Verizon, Oracle, and Twitter — have pledged support.

Businesses are paying close attention to containers for their ability to cut data center costs. Developers are also excited because they can use containers to create sophisticated software like what ride-sharing company Uber uses to connect multiple databases and servers.

The San Francisco, CA based startup Docker, which raised $95 million in April, has been the poster child for container technology and has been helping popularize it over the past year. The company has contributed its core container technology… Read More

Coming Events of Interest

Cloud Computing Boot Camp — July 30th in Washington, DC. Designed for small-to-medium businesses (SMBs) and their counterparts in government agencies and healthcare organizations whose responsibilities include evaluating, purchasing, and implementing cloud-based solutions.

The Internet of Things (IoT) Show — September 2nd-23rd in Singapore. The IoT Show will facilitate new collaborations and partnerships as well as generate new ideas and thinking. The IoT Show is about getting the prototypes out of the lab and into the market.

ADRM Working Group Meeting — September 24th via Global Videoconference. Contact the DCIA for information about joining the group and attending the meeting that will focus on interoperability among DRM platforms and simplifying DRM implementation.

Digital Hollywood Fall — October 19th-22nd in Marina Del Rey, CA. The future of the entertainment industry. Digital Hollywood debuted in 1990 and has from its start been among the leading trade conferences in its field.

2015 US Cyber Crime Conference — November 18th-20th in National Harbor, MD. This is the only event of its kind that provides both hands-on digital forensics training and an interactive forum for cyber professionals to network.

Internet of Things World Forum (IoTWF) — December 6th-8th in Dubai, UAE. IoTWF is an exclusive event that brings together the best and brightest thinkers, practitioners, and innovators from business, government, and academia to accelerate the market adoption of the Internet of Things.

Posted in Newsletters