Learn more! ->
August 28, 2015
Corporate Security
Sponsored By:
"Virginia Shooting Shines Spotlight on Cases Involving Workplace Grudges, Arguments"
"Appeals Court Affirms FTC Authority Over Corporate Data-Security Practices"
"More Than 80 Percent of Healthcare IT Leaders Say Their Systems Have Been Compromised"
"Startups in the Forefront of Battle Against Hackers"
"Consultants Seek to Bridge ‘Valley of Death’ to Stop Hacking"
Homeland Security
Sponsored By:
"TV Shooting Claims Lives of Reporter, Cameraman; Gunman Kills Self"
"Police Officer Fatally Shot in Louisiana While Responding to Report of Stabbings"
"Train Gunman Watched Jihadist Video Before Attack, French Prosecutor Says"
"Inquiry Weighs Whether ISIS Analysis Was Distorted"
"EU Migrant Crisis: Austrian Van Death Toll Rises to 71"
Cyber Security
"Ashley Madison Users Face Threats of Blackmail and Identity Theft"
"Fraud Rate Doubles as Cybercriminals Create New Accounts in Users' Name"
"How Financial Institutions Can Better Protect Digital Identities"
"Experts: Deleted Online Information Never Actually Goes Away"
"ISIS-Related Cyber War Reaches Alabama"
Virginia Shooting Shines Spotlight on Cases Involving Workplace Grudges, Arguments
Wall Street Journal (08/27/15) Elinson, Zusha
Workplace violence in the United States has received renewed attention since two television journalists in Virginia were fatally shot on Wednesday, allegedly by a former co-worker. The suspect, Vester Flanagan, was a former co-worker of the WDBJ journalists shot during a live broadcast, authorities say. Flanagan was found with a self-inflicted gunshot wound later that day. The Bureau of Labor Statistics reports that workplace homicides have declined since the 1990s, from a peak 1,080 in 1994 to 404 in 2013, compared with more than 14,000 murders overall. Most of those declines, however, involve people killed by robbers, while the percentage of people murdered on the job by co-workers or former co-workers has remained relatively flat. Joel Dvoskin, a clinical psychologist, says it is nearly impossible to predict which employees may commit a murder, but troubled and potentially unstable workers may be spotted and employers can get them help.
Web Link | Return to Headlines
Appeals Court Affirms FTC Authority Over Corporate Data-Security Practices
Wall Street Journal (08/24/15) Kendall, Brent
The Philadelphia-based Third U.S. Circuit Court of Appeals ruled Monday that federal consumer-protection groups can sue companies that fail to provide reasonable protections against theft of customers' online data. The ruling allows the Federal Trade Commission (FTC) to proceed with a lawsuit against the hotel chain Wyndham Worldwide Corp. FTC alleges that Wyndham is partly responsible for data breaches between 2008 and 2010 that led to the theft of customers' credit- and debit-card numbers. Scott Vernick, who handles data security at law firm Fox Rothschild LLP, said that the ruling was a “watershed event” that confirmed FTC's role as cybersecurity cop. Since Congress has not yet passed comprehensive data-security legislation, FTC has sought to fill in the gap, bringing more than 50 data-security cases based on its power to pursue unfair business practices. FTC said the Wyndham hacking incidents led to more than $10 million in fraud losses. The agency alleged that the company left consumer data unprotected by firewalls and used outdated software that could not receive security updates.
Web Link | Return to Headlines
More Than 80 Percent of Healthcare IT Leaders Say Their Systems Have Been Compromised
CIO (08/27/15) Mearian, Lucas
A whopping 81 percent of healthcare executives claim that their organizations have been compromised by at least one kind of cyberattack in the last two years, according to a recent KPMG survey. The report notes that only half of those executives feel adequately prepared to prevent future attacks. Compared with past reports, this one showed that attacks on healthcare IT systems have increased. Thirteen percent of respondents are targeted about once a day and 16 percent said they cannot detect in real-time if their systems are compromised. The areas with the greatest vulnerabilities within an organization include external attackers (65%), sharing data with third parties (48%), employee breaches (35%), wireless computing (35%) and inadequate firewalls (27%). KPMG listed several reasons why healthcare organizations face such a virulent threat, including the advent of accessible digital patient records and the ease of internal and external information distribution.
Web Link | Return to Headlines
Startups in the Forefront of Battle Against Hackers
Wall Street Journal (08/24/15) Garone, Elizabeth
Small businesses are moving to fill a desire among businesses and government for software and devices that can protect their data from hackers. Many of these new offerings revolve around encryption, and include companies offering encrypted email and encrypted text-massaging services. Confide, a New York-based startup, goes a step further than most such services and says that it will delete messages from its servers and the recipient's phone as soon as they are read. Private.me offers a search engine that does not store user data. Burner, based in San Francisco, offers temporary phone numbers that users can give out and have redirected to their main phone number. There are several reason that small firms are the ones coming out with these products and services. "We see the small companies and startups take chances and innovate, because they are trying to carve out a niche and/or have a new idea," says Heidi Shey of Forrester Research. Such ventures would also likely not be profitable for larger companies, notes Robert Neivert, COO of Private.me. However, Shey says that with such a large field of startups and small companies pushing their own security solutions, some inevitably make mistakes, especially in marketing their companies, for example by making vague or extravagant claims or loading down marketing with too many technical details.
Web Link | Return to Headlines
Consultants Seek to Bridge ‘Valley of Death’ to Stop Hacking
Bloomberg (08/25/15) Strohm, Chris
Los Alamos National Laboratory and New York-based consulting firm Enrst & Young LLP on Tuesday announced a new partnership through which Enrst and Young will make cybersecurity technology developed at the national lab available to private companies. The United States spends roughly $1 billion a year on unclassified research into cybersecurity, but the fruits of this research rarely filter out to the public sector due a lack of marketing and communication acumen at federal research facilities. Michael Fisk, chief information officer at Los Alamos, calls this inability to transfer technologies "the valley of death," and bridging the valley is the goal of the new collaboration with Ernst & Young. The first technology to be commercialized through the partnership is a tool called PathScan, which detects anomalous activity on networks that could indicate the presence of hackers. Ernest & Young says that PathScan is being tested at five companies where it is already proving valuable. The process that led to the licensing agreement for PathScan took about three years after it was identified as having potential commercial value by the Department of Homeland Security's Science and Technology Directorate. PathScan will be the fourth technology transferred under a program managed by the agency.
Web Link | Return to Headlines
TV Shooting Claims Lives of Reporter, Cameraman; Gunman Kills Self
Wall Street Journal (08/26/15) Barrett, Devlin; Bauerlein, Valerie
A former TV reporter shot and killed two of his former coworkers and wounded another person during a live broadcast in Hardy, Va., Wednesday morning, before crashing his car and shooting himself during a police pursuit. Vester Flanagan, 41, had worked with the victims, reporter Alison Parker and cameraman Adam Ward, at Roanoke, Va., CBS affiliate WDBJ, but was fired in 2013. Flanagan, who is black, claimed that his firing had been racially motivated, and sued the station and Ward in 2014, though his case was ultimately dismissed. Flanagan posted a first-person video of the shooting, showing a gun pointing at Parker and then firing, to social media after the shooting and reiterated his claims that he had been discriminated against. In a manifesto faxed to ABC News Wednesday morning, he claimed that the shooting was revenge for the killing of nine African-Americans at a church in Charleston, S.C., in June. Flanagan's car was spotted by a Virginia state trooper at 11:30 a.m., and she gave chase. However, Flanagan crashed his car and shot himself, and died after being taken to the hospital. Vicki Gardner, a local chamber of commerce official who Parker was interviewing, was wounded in the shooting, but survived and is in stable condition.
Web Link | Return to Headlines
Police Officer Fatally Shot in Louisiana While Responding to Report of Stabbings
Associated Press (08/27/15)
A Louisiana police officer was shot and killed Aug. 26 when he responded to a call from a house where three women had been stabbed, one of them fatally, said the sheriff of rural St. Landry Parish. Harrison Lee Riley Jr., 35, the man accused in the attacks, drove from the house in Sunset and crashed into a convenience store, barricading himself in an office. Sheriff Bobby Guidroz of St. Landry Parish said SWAT team members threw tear gas canisters into the building and used hammers and fire axes to break in. Sheriff Guidroz identified the dead as Officer Henry Nelson, 51, and Shameka Johnson, 40, and the wounded as her sister Shurlay Johnson, 34, and Riley’s wife, Courtney Jolivette Riley, whose age he did not know. Officer Nelson was the second Louisiana police officer killed in four days and the fifth in four months.
Web Link | Return to Headlines
Train Gunman Watched Jihadist Video Before Attack, French Prosecutor Says
Wall Street Journal (08/26/15) Dalton, Matthew; Landauro, Inti; Schechner, Sam
Investigators in France say there is evidence that the gunman in last week's thwarted attack on a Paris-bound train watched a radical Islamist shortly beforehand. The gunman, identified as 25-year-old Ayoub El-Khazzani, may have traveled earlier this year to the Turkish border with Syria, near territory controlled by Islamic State. According to François Molins, the Paris prosecutor, El-Khazzani used a mobile phone aboard the train to watch a YouTube video containing an exhortation to violence “in the name of the prophet,” before emerging from a bathroom carrying several weapons. Four days of investigation in four countries led French authorities to press preliminary charges against El-Khazzani. Charges include multiple counts of attempted murder as part of a terrorist act and participation in a terrorist conspiracy. Investigators are now attempting to determine whether El-Khazzani, a Moroccan national, had any accomplices.
Web Link | Return to Headlines
Inquiry Weighs Whether ISIS Analysis Was Distorted
New York Times (08/26/15) Mazzetti, Mark; Apuzzo, Matt
The Pentagon's inspector general has reportedly opened an investigation into allegations military officials have skewed intelligence assessments about the ongoing U.S.-led campaign against the Islamic State (IS) to provide a more optimistic account of the campaign to policy makers. The investigation is said to have begun after at least one civilian Defense Intelligence Agency (DIA) analyst told authorities he had evidence that officials at U.S. Central Command (Centcom) — the military headquarters overseeing the American bombing campaign — were improperly reworking the conclusions of DIA intelligence assessments intended for policy makers, including President Obama. Government rules state that intelligence assessments "must not be distorted" by agency agendas or policy views. The Pentagon IG has reportedly notified the House and Senate about its investigation, suggesting that it is taking the allegations seriously. Several leading military officials have, in recent months, painted a fairly up-beat picture of the campaign against IS, suggesting that the group has been checked and that success is inevitable, if several years away. However, anonymous officials with access to confidential intelligence assessments, including some by the DIA, say they paint a more sober picture, concluding that the group's ranks have not been significantly diminished and that it has managed to expand its reach to North Africa and Central Asia over the last year.
Web Link | Return to Headlines
EU Migrant Crisis: Austrian Van Death Toll Rises to 71
USA Today (08/28/15) Hjelmgaard, Kim
Officials in Austria report that 71 people so far have been found dead in an abandoned truck near Vienna, after originally reporting a death toll of 50. The truck had traveled to Austria from Hungary, and was most likely filled with migrants, possibly a Syrian refugee group, said local police chief Hans Peter Doskozil. The truck was discovered Thursday, parked beside a main highway that runs between Vienna and Budapest. Investigators believe that the people inside the truck had suffocated to death, and may have been in the back of the refrigerated truck for one or two days. Three Bulgarian nationals were detained in Hungary on suspicion of involvement in human smuggling. The European Union is struggling to address the issue of tens of thousands of people fleeing from war, persecution, and economic hardship in Africa and the Middle East. According to the United Nations, an estimated 2,400 people have died this year trying to reach Europe from North Africa.
Web Link | Return to Headlines
Ashley Madison Users Face Threats of Blackmail and Identity Theft
New York Times (08/28/15) Bromwich, Jonah
After hackers stole and reviewed the personal information of members of the adultery website Ashley Madison, scammers have been examining the data for potential criminal targets. Police officials in Toronto say they have already seen several spinoff crimes, such as extortion attempts, and more subtle schemes. Darius Fisher, president of the reputation management firm Status Labs, said that multiple clients have been threatened with exposure of their use of the site if they do not send bitcoin to their blackmailers. Other Ashley Madison users are at risk of being approached by criminals falsely offering them help in handling the situation, says Stephen Cobb, a digital security expert at the software company ESET. This may trick the victims into giving up even more information, or allowing someone to install malicious software into their computers. Fraudsters may use the stolen data from Ashley Madison users to create phishing emails that trick the recipients into revealing sensitive personal information or downloading software. Other victims of attacks include anyone interested in the identity of the website's members, such as suspicious spouses, who may be lured into clicking on malicious links.
Web Link | Return to Headlines
Fraud Rate Doubles as Cybercriminals Create New Accounts in Users' Name
CIO (08/25/15) Korolov, Maria
A new report from NuData Security has revealed that cybercriminals doubled their rate of account creation fraud this summer. Between May and July, 57 percent of the 500 million account creations analyzed were found to be high risk or fraudulent, a 29 percent increase from February, March, and April. Ryan Wilk, NuData's director of customer success, says that criminals are increasingly looking beyond just using stolen credit card numbers. Taking over existing accounts can cause more damage, granting access to everything from cash balances in bank accounts to frequent flier miles. The report highlights the fact that creating a brand new account is turning out to be even more profitable for criminals. Opening a new credit card account, for instance, ensures that criminals do not have to worry about a victim seeing fraudulent transaction on their monthly statements and therefore have more time to use up an entire credit line.
Web Link | Return to Headlines
How Financial Institutions Can Better Protect Digital Identities
Security InfoWatch (08/25/15) Faulkner, Alisdair
More than 100 banks and other financial institutions have fallen victim to high profile data breaches and state-sponsored hacks in recent years. While the federal government and consumers must do their parts to stay protected, a lot of responsibility does fall on financial services institutions to ensure their systems and individual accounts are not compromised. To help with safeguarding processes and the changes to the risk environment for businesses operating online, the Federal Financial Institutions Examinations Council released two joint statements earlier this year that address the two key threats financial institutions face today. The statements detail how to deal with stolen identities and the heightened risks of destructive malware that, in combination, represent a credible threat to business operations and the financial system as a whole. The statements also outline some recommended preventative strategies that financial institutions should put into place. These include protecting digital channels, like mobile devices that are often used for online banking and other transactions, leveraging global shared intelligence to more proactively counter cyber threats, and implementing integrated digital identity strategies which can enable financial institutions to meet authentication guidelines, extend online identity perimeters for businesses, and provide effective customer identity protection.
Web Link | Return to Headlines
Experts: Deleted Online Information Never Actually Goes Away
New York Times (08/21/15)
Private data submitted online probably will never be deleted completely, as illustrated by the recent Ashley Madison hack. The hackers, who stole the data about a month ago and posted it online last week, claimed that one reason for the theft was a false promise by the website to fully delete users' information for a $19 fee. Hackers say that Ashley Madison did not delete the information, but still collected the fees. Privacy experts say that, even though people have gotten used to trusting important personal information to companies, they should be aware that such information is shared more than they think. "Personal information is like money, and you don't just give away your money," said Michael Kaiser, executive director of the National Cyber Security Alliance. "In the environment we're in right now, you have to value it and think about protecting it everywhere you go on the Internet." Users should examine a website's business to see how much they value information security; they may even ask a website about its data-retention practices. The large number of significant data breaches in recent years should prompt Internet users to pause and consider whether they really should put personal information online, says Caleb Barlow, a vice president at IBM's security division.
Web Link | Return to Headlines
ISIS-Related Cyber War Reaches Alabama
CIO (08/20/15) Korolov, Maria
The war against the Islamic State has resulted in cyber attacks on websites for a sherriff's office and cultural center in Etowah County, AL, and other such attacks are likely, according to a new report from Bat Blue Networks. The security firm stated that the rudimentary Alabama attack is particularly surprising as the hacker who claimed responsibility for it has been linked with pro-American groups in the past. The hackers referred to themselves as Kurdish hackers, another surprising revelation as "the Kurds have been the most successful in battling and actually forcing Islamic State soldiers back," says Bat Blue Chief Executive Officer Babak Pasdar. However, although the Kurds and the U.S. might be on the same side when it comes to ISIS, there is a major area of frustration, Turkey's use of the conflict as a platform to target terrorists in general. This movement has affected its own independence-minded Kurd population and, according to Pasdar, the U.S. has not provided much aid to that community. Turkey's bombing of Kurdish separatists in Syria and Iraq, in particular, which has led to civilian losses, has been the biggest source of friction. Pasdar says that the "Kurds are feeling frustrated that the Turkish military is waging a war on them that has an impact not just on the paramilitary but on the civilians," and that the U.S. has remained "silent on [the] whole thing" so as not to cause any tension with Ankara. Pasdar continued on to say that the Alabama attack was most likely opportunistic, but launching cyber attacks against the U.S. would not be the "best move, politically, to get the U.S. to step in on the Kurdish side of the conflict."
Web Link | Return to Headlines
Abstracts Copyright © 2015 Information, Inc. Bethesda, MD
ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.
Unsubscribe | Change E-mail | Security Management Online | ASIS Online