-- SANS Network Security 2010, Las Vegas, September 19-27, 2010 41 courses. Bonus evening presentations include The Return of Command Line Kung Fu and Cyberwar or Business as Usual? The State of US Federal CyberSecurity Initiatives http://www.sans.org/network-security-2010/
-- SANS Chicago 2010, Skokie, Illinois, October 25-30, 2010 6 courses. Bonus evening presentations include Weaponizing LISP: Advancing the Art of Network Security and Examining the Global Underground of Malicious Actors http://www.sans.org/chicago-2010/night.php
-- SANS London 2010, November 27-December 6, 2010 14 courses. Bonus evening presentations include Latest Advances in Computer Forensics and Continuous Vulnerability Testing and Remediation: The 20 Critical Security Controls Perspective http://www.sans.org/london-2010/
-- SANS Cyber Defense Initiative 2010, Washington DC, December 10-17, 2010 24 courses. Bonus evening presentations include Browser Based Defenses; Continuous Vulnerability Testing and Remediation: the 20 Critical Security Controls Perspective; and Cyberwar or Business as Usual? The State of US Federal CyberSecurity Efforts http://www.sans.org/cyber-defense-initiative-2010/
Google Agrees to Pay US $8.5 Million to Settle Buzz Lawsuit (September 3, 5 & 6, 2010)
Google will pay US $8.5 million to settle a class-action lawsuit alleging the company violated users' privacy when it launched the Google Buzz social network in February 2010. The class action lawsuit consolidates several civil suits that had been filed against Google. The lion's share of the money will go to organizations focused on Internet privacy. The settlement proposal still needs a federal judge's approval. -http://www.theregister.co.uk/2010/09/05/google_buzz_suit_settlement/ -http://www.bbc.co.uk/news/technology-11198297 -http://www.computerworld.com/s/article/9183638/Google_settles_Buzz_privacy_lawsu it?taxonomyId=17 [Editor's Note (Pescatore): That fine equates to about 0.12% of Google's 2Q2010 advertising revenue, or a little over 2 cents per share off of Google's earnings. That doesn't seem very significant - but more importantly Google Buzz failed in the market and Google let it die off. I like to think the backlash against the privacy violations played a role in the failure of Buzz. (Liston): Google's early string of successes has given way to a series of high-profile privacy and "product" failures. These two problems appear to be related to a single root cause that in an earlier time might have been called "hubris." Google needs to reexamine its direction in light of a growing public sentiment that the search giant's reach may have extended too far. (Schultz): Google's mission is to make all kinds of information available to the masses. While this is an admirable goal, Google is running into increasingly formidable legal and other barriers. It is thus time for Google's senior management to modify this company's vision ]
The National Institute of Standards and Technology (NIST) has published "Guidelines for Smart Grid Cyber Security," a three-volume, 537-page report aimed at "facilitat [ing ] organization-specific Smart Grid cyber security strategies focused on prevention, detection, response and recovery." The publication includes "high-level security requirements, a framework for assessing risks, an evaluation of privacy issues at personal residences, and additional information for businesses and organizations to use as they craft strategies to protect the modernizing power grid from attacks, malicious code, cascading errors and other threats." -http://www.informationweek.com/news/government/security/showArticle.jhtml?articl eID=227300159 -http://gcn.com/Articles/2010/09/03/NIST-Smart-Grid-security-guidelines.aspx?admg area=TC_SECURITY&p=1 -http://www.nist.gov/public_affairs/releases/nist-finalizes-initial-set-of-smart- grid-cyber-security-guidelines.cfm -http://csrc.nist.gov/publications/PubsNISTIRs.html#NIST-IR-7628 [Editor's Note (Liston): Unfortunately, "smart grid" is just the latest in a series of technologies that have been deployed with security as an afterthought. While I applaud any effort to better secure our infrastructure, it's a bit late to talk about "security strategies" at this stage of the game. The key question is whether some of the quite-sound recommendations can be retrofit into the existing deployment models. (Pescatore): There is still an opportunity for better security to be built-in to the smart grid build out, vs. try to pretend a compliance regime like NERC/CIP will force it in later. Section 7 of the third volume has a good attack surface analysis that should be a starting point. (Paller): John Pescatore's comment illustrates one reason that this NIST document and others like 800-53 are exacerbating the nation's cyber risk instead of helping to mitigate the risk. NIST buried the critical information (the attack surface) in the 7th chapter of the third volume (after lengthy, but non-specific descriptions of 197 separate controls in more than 350 pages). A central tenet of effective security is that offense informs defense. In other words, do the most important things first! That means guidance must start with, and be organized around, the attack surface; and guidance must be prioritized according to risk from each attack vector. Which of the 197 recommendations matter most? Which must be implemented first? How will we know that they were implemented effectively? If NIST doesn't know the answers to those basic questions, what are they doing writing guidance? For failing to prioritize the guidance, and for burying readers in information of little immediate consequence, NIST earns a grade of "D" on its new report. ]
********** REALLY INTERESTING NEW PROGRAM ON SCADA SECURITY ************** How has the threat to control systems changed during the last year? Who are the new attackers? What actually happened in the Stuxnet worm attacks? What did DHS and DoD find when they conducted security assessments in control utilities and other control system users? What new technology allows some SCADA engineers to sleep well at night not worrying about attackers hacking into their control systems? Find answers to these questions and more at the: SANS 2010 European SCADA Security Summit in London next month, focusing on "changing form talk to action" You'll also learn innovative and effective governments and power companies and other industries are doing to counter the threats. http://www.sans.org/info/64398 ****************************************************************************
THE REST OF THE WEEK'S NEWS
Swedish Police Crack Down on Filesharers (September 6, 2010)
FIFA Fan Database Allegedly Stolen and Sold (September 5, 2010)
The UK information Commissioner's office (ICO) has launched an investigation into allegations that someone sold information from a database of FIFA World Cup Soccer tournament attendees for GBP 500,000 (US $770,000). The data breach appears to affect as many as 250,000 people who purchased World Cup tickets from FIFA outlets for the 2006 World Cup event that was held in Germany. Investigators are trying to determine who stole the information and why that database was not destroyed. The compromised data may include passport information. -http://www.dailymail.co.uk/news/article-1309099/Stolen-sold-Private-details-thou sands-World-Cup-fans.html -http://www.guardian.co.uk/football/2010/sep/05/fifa-passports-claims [Editor's Note (Honan): Both this story and the story on the "Former MI6 Software Engineer Gets One-Year Sentence for Attempting to Sell Information" highlight the insider threat is alive and well. ]
DHS IG Says Customs and Border Patrol Needs to Address Cyber Security Issues (September 2, 2010)
According to a report from the Department of Homeland Security's (DHS) Inspector General (IG), the US Customs and Border Patrol (CBP) has a number of cyber security issues to address. The report found that there was no regular review of employee access rights changes; no strong password enforcement; that systems were not configured to lock users out after a certain number of failed login attempts; that accounts were still active after 45 days of inactivity; and that users were not restricted to accessing the least amount of info necessary to perform their duties. -http://www.nextgov.com/nextgov/ng_20100902_6263.php?oref=topnews
Former MI6 Software Engineer Gets One-Year Sentence for Attempting to Sell Information (September 3, 2010)
A software engineer who worked for the UK's MI6 Secret Intelligence Service has been sentenced to a year in jail for trying to sell electronic copies of secret information. Daniel Houghton pleaded guilty to violations of the Official Secrets Act. Among the information Houghton was attempting to sell were details of data gathering software and lists of MI6 staff members. Houghton tried to sell the information to Dutch agents, who initially thought the offer was a hoax, but eventually alerted MI6 to the situation. Houghton was scheduled to be released on Friday, September 3 because he has already served 184 days in custody. -http://www.bbc.co.uk/news/uk-england-london-11176434 -http://www.guardian.co.uk/world/2010/sep/03/mi6-man-jailed-selling-names
12-Year Sentence for Advance-Fee Scam Mastermind (September 3, 2010)
Eugene Schultz, Ph.D., CISM, CISSP is CTO of Emagined Security and the author/co-author of books on Unix security, Internet security, Windows NT/2000 security, incident response, and intrusion detection and prevention. He was also the co-founder and original project manager of the Department of Energy's Computer Incident Advisory Capability (CIAC)
John Pescatore is Vice President at Gartner Inc.; he has worked in computer and network security since 1978.
Stephen Northcutt founded the GIAC certification and currently serves as President of the SANS Technology Institute, a post graduate level IT Security College, www.sans.edu.
Prof. Howard A. Schmidt is the Cyber Coordinator for the President of the United States
Dr. Johannes Ullrich is Chief Technology Officer of the Internet Storm Center and Dean of the Faculty of the graduate school at the SANS Technology Institute.
Ed Skoudis is co-founder of Inguardians, a security research and consulting firm, and author and lead instructor of the SANS Hacker Exploits and Incident Handling course.
Rob Lee is the curriculum lead instructor for the SANS Institute's computer forensic courses (computer-forensics.sans.org) and a Director at the incident response company Mandiant.
Rohit Dhamankar is the Director of Security Research at TippingPoint, where he leads the Digital Vaccine and ThreatLinQ groups. His group develops protection filters to address vulnerabilities, viruses, worms, Trojans, P2P, spyware, and other applications for use in TippingPoint's Intrusion Prevention Systems.
Tom Liston is a Senior Security Consultant and Malware Analyst for Inguardians, a handler for the SANS Institute's Internet Storm Center, and co-author of the book Counter Hack Reloaded.
Dr. Eric Cole is an instructor, author and fellow with The SANS Institute. He has written five books, including Insider Threat and he is a senior Lockheed Martin Fellow.
Ron Dick directed the National Infrastructure Protection Center (NIPC) at the FBI and is the incoming President of the InfraGard National Members Alliance - with 22,000 members.
Mason Brown is one of a very small number of people in the information security field who have held a top management position in a Fortune 50 company (Alcoa). He is leading SANS' global initiative to improve application security.
David Hoelzer is the director of research & principal examiner for Enclave Forensics and a senior fellow with the SANS Technology Institute.
Mark Weatherford, CISSP, CISM, is Chief Information Security Officer at the North American Energy Reliability Commission (NERC).
Alan Paller is director of research at the SANS Institute.
Marcus J. Ranum built the first firewall for the White House and is widely recognized as a security products designer and industry innovator.
Clint Kreitner is the founding President and CEO of The Center for Internet Security.
Brian Honan is an independent security consultant based in Dublin, Ireland.
David Turley is SANS infrastructure manager and serves as production manager and final editor on SANS NewsBites.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit http://portal.sans.org/