Cyber Security Awareness Month

October in National Cyber Security Awareness Month, this is a good time to review the security practices and conduct sessions to make users aware of the program. This is also a good time to think on the home front to see what are the cyber threats and assess the defensive measures taken by you and your family members. Educate the kids and other family members on the importance of cyber security. Some useful links are below

http://www.us-cert.gov/

http://www.staysafeonline.org/

http://www.msisac.org

www.onguardonline.gov

www.ikeepsafe.org

Phishing and Spam IQ Quiz

You think you are good at identifying spam and phishing emails? Take this small quiz and test your skills. Don't be disheartened by not getting 10/10, only 7.4% of test takers got 100%.

On the first page they provide you with some helpful hints, try not to look at those hints initially and see how you score. By the way, I got a 10/10.

You need more challenge? Head on to CMU labs developed phishing game Phil

Microsoft's Free Anti-malware Tool

Microsoft has released the final version of the Microsoft Security Essentials program. The free malware protection software which until now was available only to a limited amount of beta testers is now available for download, it guards against viruses, spyware, and other malicious software.


Now, the obvious question is how good is this. According to the washingtonpost report,


"AV-Test ran MSE against 3,732 samples of malware that are currently infecting PCs around the world, and found that the program blocked all of them, both when the samples were opened or accessed and when the malware was manually scanned."

New SANS forensic certification

Rob Lee at SANS sent this email requesting security professionals to rate the requirements of a new Forensic certification GCFE
========
If you already hold forensics credentials such as the GCFA, your input will be valuable in shaping the future of the new GCFE credential. The survey requires you to identify yourself and list your qualifications. Your name may be listed in the validation report that is submitted for accreditation. This survey will take an estimated 15 minutes of your time. The JTA can be accessed at the link below. It will be available through September 30th.

https://www.surveymonkey.com/s.aspx?sm=vHDHw0aplAuk0elhyRc0fA_3d_3d

=======

Microsoft application assessment tools

As mentioned in the previous blog cybercriminals are increasingly attacking applications and hence it is critical to develop secure applications through standardized SDLC processes. Microsoft offers many tools to test and validate the security of the developed application and recently they released number of tools in this area

The latest Anti-Cross Site Scripting (Anti-XSS) Library

Risk Tracker tool that manages and tracks information security risk.

BinScope Binary Analyzer. Microsoft says that their developers and testers are required to use this tool as part of the SDL. It analyzes the binaries for a wide variety of security protections such as detecting stack-based buffer overflows and ensuring safe exception handling

CAT.NET v1 CTP is a binary analysis tool to identify XSS, SQL Injection and XPath Injection in the code.

Cyber Security risks

Cyber criminals are increasingly attacking applications, this is the findings of a study published by SANS this week. The top cyber security risks report combines intelligence from TippingPoint, Qualys and SANS themselves. The two main risk areas are listed below.
"Waves of targeted email attacks, often called spear phishing, are exploiting client-side vulnerabilities in commonly used programs such as Adobe PDF Reader, QuickTime, Adobe Flash and Microsoft Office. This is currently the primary initial infection vector used to compromise computers that have Internet access."

"Attacks against web applications constitute more than 60% of the total attack attempts observed on the Internet. These vulnerabilities are being exploited widely to convert trusted web sites into malicious websites serving content that contains client-side exploits."

As you can see the two areas that cyber criminals look for are client side application vulnerabilities where there have been many 0-days and traditionally patch releases have been slow. The example they have shown is very real and something that we see on a daily basis, the latest example being the New York Times incident

If you combine this with the Verizon report, we can assume that client side applications and web application vulnerabilities are being increasingly used as entry points but cyber criminal's main target is getting sensitive information from organization's critical databases.

The SANS report also lists some of the mitigation steps

Attacks on BGP protocol

BGP is the protocol that runs on the Internet backbone, so DoS attacks against BGP could be devastating. Last month there was a targeted DoS against BGP protocol, Cisco corrected this issue, read the announcement. http://www.cisco.com/en/US/products/products_security_advisory09186a0080af150f.shtml

http://www.gossamer-threads.com/lists/nanog/users/117321?page=last

http://www.renesys.com/blog/2009/08/staring-into-the-gorge.shtml

Data breach news and analysis

Folks at Open Security Foundation have started a new web site BreachCenter.com which will offer news and analysis on the various data breaches. From the announcement,  
"BreachCenter.com is a free and dynamic community of interest dedicated to helping companies mitigate the damages associated with the loss of personally identifiable information. We provide news, opinions, expert analysis, white papers, dialogue and reviews on data breach recovery."  


Following are some other sites where we can get data breach and identity theft information.  
http://datalossdb.org  
http://www.privacyrights.org  
http://zone-h.org  
www.voltage.com/data-breach  
http://attrition.org/dataloss (pre 2008)  


FTC lists the cases involving the privacy of consumer information under Section 5 of the FTC Act: http://www.ftc.gov/privacy/privacyinitiatives/promises_enf.html http://www.ftc.gov/privacy/privacyinitiatives/safeguards_enf.html

Online reputation

One of the readers asked about RBLs, so here you go.

What is your reputation on the Internet world? How do you know that you don't have any zombie machines in the inside of your network sending out spam emails? Your domain name and IP address gets classified as spam originators by various reputation authorities if they identify any systems or networks within the domain sends out spam. Such reputation authorities lets you identify if they classified any devices in your domain as spam originators. Commercial spam filtering devices does regular lookups to these authorities to determine and block such spam sources.

http://www.spamhaus.org/
http://uribl.com/index.shtml
http://www.spamcop.net/bl.shtml
http://www.barracudacentral.org/lookups
http://www.senderbase.org/
http://cbl.abuseat.org/
http://www.njabl.org/lookup.html
http://www.sendmail.com/sm/resources/tools/ip_reputation/

Cisco IPS - new feature

For those who use Cisco IPS devices, check the following announcement,

"IPS 7.0 contains a new security capability, Cisco Global Correlation, which uses the immense security intelligence that we have amassed over the years. At regular intervals, Cisco IPS receives threat updates from the Cisco SensorBase Network, which contain detailed information about known threats on the Internet, including serial attackers, Botnet harvesters, Malware outbreaks, and dark nets. The IPS uses this information to filter out the worst attackers before they have a chance to attack critical assets. It then incorporates the global threat data in to its system to detect and prevent malicious activity even earlier."

Read the release notes to get more information.

SNORT and IPTABLES users may be familiar with a similar concept wherein you could do the lookups to various Realtime Blackhole Lists or RBLs