Billion Electric improves the efficiency of cros... » Billion Electric Corp. has launched the world's first 3G/4G LTE router designed to maximize producti... Social registration tool increases networking valu... » The Emergency Services Show is using the GleanIn social registration tool to harness the power of so... A10 Networks promotes world wide technology (WW... » SAN JOSE, Calif.: A10 Networks has announced that World Wide Technology (WWT), a market-leading syst... Linux and BSD web servers at risk of sophisticat... » ESET has published its in-depth technical research paper, entitled ‘Unboxing Linux/Mumblehard - Mutt... The O2 arena awards five-year event control contra... » Integrated Security Consultants (ISC) Ltd, has been awarded a five-year contract to supply CCTV and ... Tripwire Now discovers more than 100,000 condition... » LONDON, UK:  Tripwire, Inc., has announced that Tripwire® IP360 TM now discovers more than 100,000 c... Octavian launch new training giveaway on World Hea... » Octavian Security has unveiled a competition to coincide with the launch of the newly accredited Oct... Nigeriaghanistan: A nation's backward march to neo... » 23"Take away from Me the noise of your songs; I will not even listen to the sound of your harps. 24"... Lord's to host inter services T20 Cricket Competot... » Vigilance can report that the Combined Services Cricket Association can confirm that the Inter Servi... BeyondTrust appoints former Northrop Grumman Chair... » PHOENIX: BeyondTrust has appointed Dr. Ronald D. Sugar, former Northrop Grumman Chairman and CEO, to...

CLICK HERE TO

Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.

READ MORE

Subscribe to Vigilance Weekly

Information Security Header

London: Reacting to a Wall Street Journal report that the top US spies have warned of the rising threat of state-sponsored hacking, social engineering, APTs and other security breaches, security expert Yaki Faitelson has noted that most organisations lack the basic controls that can help them to quickly remediate and learn from an attack, and in many cases prevent or limit breaches in the first place.

“Most of these attacks are not that sophisticated, and even if they are they don’t need to be to do damage if basic controls aren’t in place. We can’t ignore fundamental data protection “blocking & tackling” and expect to protect ourselves from basic threats, much less sophisticated attacks.

“Unfortunately what we're seeing is that basic controls just aren’t there for most organisations— for example, in our survey on data protection, only 19% of organisations reported that they monitor all access activity across common data stores, and 27% reported that they audit no access activity[1]. Without basic auditing, it’s no wonder that organisations have a difficult time spotting intrusions and misuse. Recovering from security incidents is also much more difficult when you don’t have a record of what was accessed.”

Faitelson noted a recent incident where Varonis identified hackers who had signed on as contractors at a large enterprise organisation. The individuals’ unusual download activity was tracked and perpetrators spotted, and further wrong-doing prevented.

While the specific anatomy of each attack differs, most attacks can be prevented or minimised with fundamental controls. Spear-phishing attacks, for example, are far worse when the compromised accounts have access to large amounts of data that aren’t relevant for them, and there is no audit trail of what the compromised accounts access," said Faitelson, who is CEO and co-founder of the New York-based data governance provider Varonis.

Faitelson also cautioned against overuse of the term "cyber warfare" to describe ongoing attacks, and agreed with comments made this week by President Obama. "You always have to be careful with war analogies -- there's a big difference between them engaging in cyber espionage or cyber attacks and, obviously, a hot war," Obama told ABC News in the interview, which was taped on Tuesday but aired on Wednesday. "What is absolutely true is that we have seen a steady ramping up of cyber security threats." (source: http://www.chicagotribune.com/business/technology/chi-cyber-attacks-more-hacking-attacks-from-china-20130313,0,1295096.story)

"Just as bankers must always be on the lookout for fraud, we must now always be vigilant about protecting our information– it’s just a part of our information economy. We have to shift the way we think—data is valuable. Don’t be surprised when people try to get it, not just a certain country or individual," Faitelson said.

Organisations and individuals need to treat their emails, files, and other data like currency. Look at their information like assets on a balance sheet, he advises.

Faitelson recommends these steps:

Know where your assets are

Learn to assess the value of your information assets

Put basic controls around them – The 4 A's:

· Authentication (verify the user is who they claim to be – multifactor is better)

· Authorization (make sure they only have access to the data they need)

· Auditing (all access must be monitored)

· Alert (analyse activity for potential abuse)

Make sure people use protected, authorized platforms

Focus on the balance between productivity and security—people need a modern work experience that doesn’t put organisational data at risk

For more information on state-sponsored hacking, see http://online.wsj.com/article/SB10001424127887323826704578356182878527280.html?mod=WSJ_hpp_LEFTTopStories