Cyberspace Security Review

On Friday (May 29, 2009) President Obama announced the nation’s plan to defend against attacks on the nation's computer networks; a “strategic national asset.” This plan includes appointing a Cyber-Security Chief, whom he has not yet chosen, in the White House. Obama will sign a classified order within the coming weeks that will create the military cybercommand.

He stated that cyber-criminals have cost US citizens over $8 billion worth of stolen data and that the figure worldwide was up to $1 trillion.

The announcement came with the release of the Cyberspace Security Review, a 76 page document that had 60-days to be completed from the date of the initial request. The Cyberspace Security Review explains how the US intends to secure its critical network infrastructure. It was stated that the review was necessary because, “America's failure to protect cyberspace is one of the most urgent national security problems facing the new administration”, and that, “our digital infrastructure has already suffered intrusions that have allowed criminals to steal hundreds of millions of dollars and nation-states and other entities to steal intellectual property and sensitive military information.”

The Cyberspace Security Review made the following 10 recommendations for near-term action:

1. Appoint a cybersecurity policy official responsible for coordinating the Nation’s cybersecurity policies and activities; establish a strong NSC directorate, under the direction of the cybersecurity policy official dual-hatted to the NSC and the NEC, to coordinate interagency development of cybersecurity-related strategy and policy.
2. Prepare for the President’s approval an updated national strategy to secure the information and communications infrastructure. This strategy should include continued evaluation of CNCI activities and, where appropriate, build on its successes.
3. Designate cybersecurity as one of the President’s key management priorities and establish performance metrics.
4. Designate a privacy and civil liberties official to the NSC cybersecurity directorate.
5. Convene appropriate interagency mechanisms to conduct interagency-cleared legal analyses of priority cybersecurity-related issues identified during the policy-development process and formulate coherent unified policy guidance that clarifies roles, responsibilities, and the application of agency authorities for cybersecurity-related activities across the Federal government.
6. Initiate a national public awareness and education campaign to promote cybersecurity.
7. Develop U.S. Government positions for an international cybersecurity policy framework and strengthen our international partnerships to create initiatives that address the full range of activities, policies, and opportunities associated with cybersecurity.
8. Prepare a cybersecurity incident response plan; initiate a dialog to enhance public-private partnerships with an eye toward streamlining, aligning, and providing resources to optimize their contribution and engagement.
9. In collaboration with other EOP entities, develop a framework for research and development strategies that focus on game-changing technologies that have the potential to enhance the security, reliability, resilience, and trustworthiness of digital infrastructure; provide the research community access to event data to facilitate developing tools, testing theories, and identifying workable solutions.
10. Build a cybersecurity-based identity management vision and strategy that addresses privacy and civil liberties interests, leveraging privacy-enhancing technologies for the Nation.

What is promising about the Review is that there's repeated focus on outcomes as opposed to the inputs. Too often forward progress is hindered by the inefficient efforts of trying to define process before goals and objectives are clearly defined and understood. Rather, the Review consistently attempts to make it clear what the strategic outcomes are, and from those objectives, the development of process will be guided.

The Review also states, “Other structures will be needed to help ensure that civil liberties and privacy rights are protected.” The inclusion to help protect our privacy and civil liberties is an indication of the balanced intention of the plan.

Money will also be set aside for research and development of security technologies, from which there will be significant opportunity.

What I'm not certain about is the overall effectiveness the Cyber-Security Chief will have. Specifically, the position will not have direct access to the president. As a result, this position may not be high-level enough to prevent the almost certain bureaucratic nonsense, internal bickering and games that could waste millions/billions of dollars.

Though the Review solely focusses on defensive measures, I'm also curious what efforts are underway, if any, towards the development and potential use of cyberweapons.

Overall, the document doesn't suggest that there will be any major changes that will affect the private sector within the near term. The Review recommends specific changes to the direction of future US policies. Within the mid-term I imagine that lawmakers will develop regulations that will require the sharing of security incident data from the private sector with the government, presumably tempered with the commitment to ensure civil liberties. I anticipate that we will also see more emphasis put towards penetration testing and incident response.

Steve

###

Some of the Best Ways to Lose Your System Data

By: Nick Pegley
Have you ever thought about the best ways to be negatively affected by a disaster, get hacked, or otherwise part with data stored on your computers? Here are some of the best ways to lose system security, in no particular order:

1. When an employee quits or is let go, leave his network log ins and e mail accounts enabled. You never know when he might want to check in on things.
2. Rely solely on technology. Firewalls, encryption and antivirus software are all you need to protect your information.
3. Completely outsource your information security initiatives. There's no need for anyone inside your organization to worry about such matters.
4. Leave your operating systems and software applications with the default settings. System hardening is for the birds.
5. Don't train your users on your security policies and what to look out for, such as unsolicited e mail attachments and common hacker activities. Your users can't be burdened with more training.
6. If you do happen to have a security policy, never refer to it, enforce it, update it or do what it says.
7. By all means, don't take an inventory of your information systems or document your network.
8. Don't pay attention to or even bother to understand what you're trying to protect.
9. Don't patch your software or update your virus signatures, and never, ever, run vulnerability assessments to detect newly discovered software flaws and system misconfigurations. It s just too time consuming.
10. Respond to hacker attacks, viruses and other intrusions as they happen don't be proactive in dealing with them.
11. Ignore all known best practices and international information security standards from the International Standards Organization, Internet Engineering Task Force, SANS Institute, and your local information security consultant, to name a few.
12. Leave your databases, especially those containing credit card or other confidential information, unencrypted. And be sure to store them on publicly accessible servers.
13. Run your business without disaster recovery and business continuity plans. After all, you can think clearly and make critical decisions under pressure, right?
14. Don't monitor your systems. They'll be fine running by themselves, and if anything major happens with the integrity or availability of your information, you'll be notified automatically, won't you?
15. Don't back up your data, but if you must, don't test your backups. Also, leave your backup media on site preferably sitting on top of an uninterruptible power supply.
16. Don't create any security policies that document how you re safeguarding your information to protect your organization and clients from information disasters and legal liabilities.
17. Apply the principle of greatest privilege. Give all users the greatest amount of access to your information systems. Everyone should have access to everything ... it's only fair, right?
18. Don't subscribe to security bulletins and mailing lists, and don't ever read information security trade magazines.
19. Don't, under any circumstances, get upper management involved in information security initiatives. They're business focused and shouldn't be bothered or even care about technology or the liabilities associated with their information, right?
20. Use passwords that consist of your pet's name, your name, your mom's maiden name, or your birthday. That way, you won t forget them. Better yet, just use "password" for your passwords. Also, don t forget to write them down and post them on your monitor or keyboard.

And, last but not least:

21. Leave your servers and network equipment in a room to which everyone, including outsiders off the street, has access.

By following these practices you can be sure that your computers will be an easy target for viruses, disgruntled employees, hackers, and others. You can show up to work each day with the pride of knowing that there's an excellent chance that your business data will be missing when you arrive. It's just a matter of time, and it s all easily achieved.

Author Resource:-> Nick Pegley is VP Marketing for All Covered: Technology Services Partner for Small Business, providing disaster recovery solutions and technology services in 20 major U.S. metro areas.

Article From Zing Articles - Best Free Articles on all topics

Microsoft out-of-band security bulletin for October 2008

Microsoft recently issued an out-of-band security advisory for a vulnerability in the server service that could allow remote code execution (MS08-067). Due to the criticality of the vulnerability, Microsoft has released a fix out-of-band (i.e., not on the regular Patch Tuesday).

It is strongly recommended that patches be tested and applied to all vulnerable systems you administrate as soon as possible. According to one source, targeted attacks using this vulnerability to compromise fully-patched Windows XP and Windows Server 2003 systems have been seen.

Advisories

MS08-67

SecurityFocus

Additional Information

Technet Blog

Steve
###