Link: http://titssn.net

Good day to you,

Over the past 48hrs I have been working on various planning and development issues around the Swine Flu Virus outbreak and I have been consumed by it in more ways than one. I will have to reschedule my webcast for this evening to a later date of which will be announced soon. The timing of this webcast was aligned with the eminent release of our Social Networking site but will have to be done after it launches.

I apologize for the late notice but I have a few pressing issues that requires my attention for the rest for the evening and I’m making schedule changes left and right to adjust to these new developments.

Please stay tuned for new webcast date.

Thank you very much and have a great day.

~Brett A. Scudder~
The IT Security Attaché

Link: http://titssn.net

Good day to you,

So what’s the word with and about our network?

Ever since the info leaked about our social network I have received a number of interesting comments, inquiries and feedback and I can’t begin to tell you how excited (more now than ever) I am about this. For the past 8 months we have been working on the new structure of TITSSN to create a converged resource for the network to operate in/from due to the vast extensive reach of our education and awareness programs, initiatives and focus. We have an international presence that has created partnership and alliances in countries around the world and we had to factor in all these different variables. The language variables, time differences, cultural differences, legal differences and the aggregating of all of them all played a significant factor in this decision making process and we tried to create the most comfortable yet resourceful setting to work and grow in..

We looked at various content management systems and other collaborative solutions but when you really look into it, TITSSN is a network of partners, associates, customers, clients, fiends and peers in and about technology with a special emphasis on the security pieces of it. If it is a technology product, solution, device or tool, we provide the needed security, know how, solutions and guidance to support it. So in essence, TITSSN is a converged network of resources and as such is what we needed to address with this initiative.

So, how do we address that?

As a social network where our members, partners, associates, vendors, developers, security professionals, IT professionals and people in general will come to learn more about the state of the IT Security Threats Landscape, we are making every effort to harness the true education, awareness, support, services and resources needed to help create a resilient social network specific to technology and IT Security. As an industry leading organization comprising of industry specialists, executives, developers, professionals, vendors and educators, we must take this approach to making this happen in a concerted way thus we bring you, The IT Security Suite Network’s Social Network which will be officially launched on May 1st 2009.

The network will provide features such as:

Blogging
Forums
Featured products and recommendations
Featured companies and information about them
Special discount offerings on services and support from our network members
Polls
Recommendations
Points towards membership benefits
Interviews
Collaboration and networking
Events managing and distribution
Experts’ collaboration exchanging of ideas on specific topics, issues and things in the security space
Group discussions on specific topics
Audio/Video/Text IM features
Best practice guides on general IT security issues
Security requests and support
Employment/consulting opportunities
And webcasts.

Some of the groups already created to address specific topics such as:

CyberWar - on, about, awareness, information, collaboration
Viral Outbreaks - containment, response, prevention
Small Business IT Security - securing the small businesses
TITSSN’s General Network Members
IT Security Best Practices – General
IT Security Training and Development – General
Voices of IT Security
Incident Response - What happens when something goes wrong/bad?
Breach Notification Laws - state laws
IT Security Facts and Myths
NYSBS - New York Small Business Server Users Group
NYITSUG - New York IT Security Users Group
The Privacy Suite
The Compliance Suite (Regulatory/Non Regulatory)
ENGAGED ~ENabling Greater Awareness, Growth and Educational Development~
IT Security Requests and Support
IT Security Service Providers ~ITSSP~
IT Security Leaders
Wireless Security
Viral, Spyware, Malware Detection and Removal - the growing trends
Endpoint Security - What are they, why they are vulnerable and how to protect them
Computer Forensics - Data and Network
Hacking Unleashed - Ethical/Unethical - the world of hacking
Mobile Security - securing the mobile users/devices and they data they host
Physical Security - a critical part of your security model
Viral Outbreaks - containment, response, prevention
Business to Business IT Security "BtBITS" - businesses protecting
each other’s interests
Perimeter Security - securing the perimeter
IT Security in our educational institutions - curriculum upgrade

These are just some of the features of the network and will be available for all at the time of launch as we try to bring everything together under the social networking model. As more people join they will be creating the needed pieces (blogs, groups, forums, polls, etc) that will be suitable for them. We are very excited about this and have been working diligently on testing and enhancing the features to make it very valuable and effective for all.

So stay tuned and get ready for this awesome new network and we look forward to the support of everyone towards this initiative. We will have an official press release for launch.

Thank you very much and have a great day. We apprecilove your business and support and look forward to serving you more.

~Brett A. Scudder~
The IT Security Attaché | http://theitsecurityattache.com | Blogs http://theitsecurityattache.com/blogs
President/CEO/Chairman/Founder/Security Architect
~TITSSN ~The IT Security Suite Network~ | http://titssn.net | TITSSN’s Blogs http://titssn.net/blogs

Link: http://theitsecurityattache.com/blogs

Good day to you,

I will be at a Ready Rockaway Disaster Preparedness Summit today in Far Rockaway and will not have access to voice nor emails for the day. I will check messages on my return this afternoon.

As I had mentioned, our month training and development hands-on workshop was rescheduled for this reason and a new date will be announced this evening.

Thank you and have a great day,

~Brett A. Scudder~
The IT Security Attaché

Link: http://theitsecurityattache.com/blogs/2009/04/13/self-employed-home-based-business-must-take-it-security-very-seriously/

Good day to you,

I would like to take this opportunity to share some very critical information with the self employed and home based business owners about the state of The IT Security Threats Landscape ~TITSTL~ and how it affects you. This is a discussion I have every day as more and more people in these categories are finding out the real effects and impacts of these threats are not excluding them and that they fall very much into the mix of it. As the economy tightens its grip on our lives, those who are being laid off are turning to home based and self employed business thus sparking an increased growth in this area of business. The SMB space has grown tremendously since his recession and to that end has become a serious security issue for us security professionals as we look across the IT Security Threats Landscape horizon.

Therefore, the reality of the issue must be faced thus bringing the question of, what am I to do about it.

I have published numerous articles on these threats, preventative measures and how to deal with the security issues of today and tomorrow on my blogs but I am going to do this as a summary of those here.

First let me say this, if it requires a security patch (let’s just keep it at security for now), it is vulnerable.

What does this mean?

Simple, any operating system, Microsoft, Mac, Linux, Solaris, you name it, that requires a security patch for any reason is vulnerable. The patch is to prevent exploit of the vulnerability right so it is a security risk.

I had to get that out of the way so that we wouldn’t get into the ridiculous argument of which is more secure than the other. The way I see it is simply that, if a door is left open for anyone to come through it, the length of time left open versus the threat that comes through it is just as critical. So, any open door is a threat no matter where. What comes through it may differentiate the severity. They all have their insecurities at some point but how the vendor/developer addresses it lessens the impact and wide scale visibility of the issue. While some may announce these vulnerabilities and findings, other may patch/update them behind the scenes thus limiting the visibility and knowledge of the user.

Second, anti-virus alone is NOT going to protect you from the threats of today. It takes a multi-layered approach and as such, the various layers of protection must be enforced. So telling yourself that you have anti-virus protection on your PC is being as naïve as saying the threats doesn’t affect me and i’m not worried about them. While it is true that most anti-virus vendors are bundling multiple threat protection/prevention layers into their solutions, the proper configuration becomes the caveat to that solution. While many deploy with an out of the box config, there will be tweaks needed to customize it to your environment and needs. So one must understand what is being deployed and if it will provide the layers of protection needed.

So why is IT Security so serious for me as a self employed or home based business?

Well, ask yourself these questions,

What is it that you do and how do you do it?
Do you use email?
Do you send emails to customers/clients/partners/associates/potential clients?
Do you leverage the powers of social networking/media (Twitter, LinkedIn, MySpace, Facebook, Ning and the list goes on) today?
Do you use IM for personal and/or business use?
Do you browse the internet for data/information on whatever you’re working on or researching?
Do you do online banking or shopping?
Do you download multimedia contents from the web (music, movies, flash videos, etc)?
Do you download online presentations (PDF, PowerPoint)?
Did you know that PDF files presented one of the biggest security risks over the past 2 years but is the most widely distributed online document format?
Do you have a printer or some media player connected to you system(s) at home or in the office?
Do you have any applications running on that system aside from the operating system?
Do you know of the Breach Notification Law in your state and what it means for you?
When was the last time you downloaded a keygens or crack file to open full access to that app or game you really wanted but didn’t want to buy/pay for?
Maybe you didn’t crack/keygen it but someone did and opened a backdoor which planed a rootkit or some nefarious threats on your system(s). What happens when you use that for business purposes, what are you spreading to those you collaborate with?

Well by now i’m sure you’ve caught my drift and I don’t have to get technical for you to see how you’re affected. All these questions pose security risks in various ways and are able to be stopped, prevented and protected if the proper education, awareness and measures are put in place. Don’t ask if you’re affected or if I should be taking these things seriously, you must. You are as much a risk to me as I am to you if the proper steps are not implemented to secure your system and the data/information you have sitting on it about me, you and those you collaborate with.

That system is being used for personal and business use and at some point the access to/from or by a threat is heightened because of the lack of separation of the two. A system that is used by everyone in the home should not be the same used for doing your business. When someone in the home decides to crack that app and opens that backdoor, you’ll never know what can come through it and what your risk factor will be or are. Separate the two, business is business and personal is personal. The cost of a system today is much more affordable than a few years ago so it shouldn’t be a problem to get an extra one.

You are not a small business because you have 5 people working for you. You are not a small business because you only have 5 computers in your office or where you decide to conduct your business. To me as a security professional you are not a small business (home based or in an office) when you have records/information and access to 5000 people. A doctor who has an office with 5 employees and 8 systems managing 4000 patients’ info is not a small business in my eyes. If you’re a consultant running your own business and you manage systems or information for your clients you’re now there biggest risk because it’s your responsibility to control that. Every PC must be secured whether it is connected online or not as you never know if/when it will cross the line. This is how I see security.

When you decide to start doing business today you must consider the role you play with those in which you will be doing business and the kinds of interaction you will have with them. When sending an email from an infected system (whether you did or the resident worm) it is still coming from you and the possible effect on the recipient(s) can be adverse which may lead to legal issues.

When using social network can enhance your presence and what you do significantly, it is also an area of heightened risk both personally and professionally. Know the need and use it accordingly. Social networks are the future of collaboration but one must decide why the need and create the separation. If it’s for personal use one should always remember the impact on themselves as they are now putting themselves out there to the world. If for business, one should decide on how they want to be seen and what they would like the world to know about them and what they do. Social networking is a great thing to have and use, it’s the management and control of that presence that matters. The threats people face on social networks are the same they would face outside of it but just through a different medium. Educate yourself on these things and you will be ok.

As for the Breach Notification Law, most people didn’t even know of such laws about digital contents and its security. I strongly suggest you take a look at the law of your state and understand the legal and financial issues it presents for you. Learn it, know it, and understand it. If in doubt, reach out.

The active Conficker worm should be enough of an eye opener for you and if you don’t know what it is then you may have bigger problems that I thought. Security is not just about you, it’s about your way of life today both on and offline. I am not here to scare you but it is better to know before than after as the damage control, legal and financial issues after the fact is much worse and a very daunting issue.

As for the online scams, phishing and SPAM, it is only going to get worse and until you educate and make yourself more aware of and about them, you may fall victim to them as they are craftier than ever.

Ok so I have chatted enough and now you’re saying this is too much so I will leave a few articles of reference. Feel free to contact me if you’d like to discuss further and in more details.

The Conficker Worm – my review
A grim day for browser security at hacker contest
State Security Breach Notification Laws as of December 16, 2008 and the Conficker worm
IT Security Education and Awareness 04-09 #1 - IT Security is a people problem, not an industry one
Apple Mac users warned of web-based malware threats RSPlug-F Mac Trojan horse distributed via HDTV website
TITSSN leverages the Twitter network for critical alerting, notification and network happenings (meetings and events) as of April 1st 2009
Security/Privacy Awareness 03-09 #1 - Do you understand the breach notification law is in your country/state, do you know what it means, all are affected.

Thank you and have a great day,

~Brett A. Scudder~
The IT Security Attaché

Link: http://blogs.zdnet.com/BTL/?p=16082&tag=nl.e019

Conficker wakes up, updates, drops payload
April 9th, 2009
Posted by Andrew Nusca @ 4:09 am | http://blogs.zdnet.com/BTL/?p=16082&tag=nl.e019
Categories: Security

The Conficker worm is finally active, updating via peer-to-peer between infected computers and dropping a mystery payload on infected computers, Trend Micro said on Wednesday.

CNET’s Elinor Mills reports that researchers are analyzing the code of the software that is being dropped onto infected computers and suspect that it is a keystroke logger or some other program designed to steal data from the machine.

The software appeared to be a .sys component hiding behind a rootkit, which is software that is designed to hide the fact that a computer has been compromised, according to Trend Micro. The software is heavily encrypted, which makes code analysis difficult, the researchers said.

Just yesterday, Zero Day blogger Dancho Danchev noted that a Conficker copycat was already making its rounds.

According to a post on the TrendLabs Malware blog, the awakened worm tries to connect to MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com as a way to test that the computer has Internet connectivity. It then deletes all traces of itself in the host machine, and is scheduled to shut down on May 3.

Mills reports:

Because infected computers are receiving the new component in a staggered manner rather than all at once there should be no disruption to the Web sites the computers visit, said Paul Ferguson, advanced threats researcher for Trend Micro.

“After May 3, it shuts down and won’t do any replication,” Perry said. However, infected computers could still be remotely controlled to do something else, he added.

The development was found when Trend Micro researchers noticed a new file in the Windows Temp folder and a large encrypted TCP response from a known Conficker P2P IP node hosted in Korea:

Two things can be summed up from the events that transpired:

1. As expected, the P2P communications of the Downad/Conficker botnet may have just been used to serve an update, and not via HTTP. The Conficker/Downad P2P communications is now running in full swing!

2. Conficker-Waledac connection? Possible, but we still have to dig deeper into this…

As for the second point, researchers said the worm tries to access a known Waledac domain and download another encrypted file, but they’re still trying to examine the connection.

More Conficker news on ZDNet:

· Dancho Danchev: Conficker worm’s copycat Neeris spreading over IM
· Adrian Kingsley-Hughes: Friday Rant - Conficker worm hype
· Ryan Naraine: Eyeballing Conficker with eye-charts and maps
· Tom Espiner: Conficker an April Fool’s joke? Maybe not

Andrew J. Nusca is an assistant editor for ZDNet.com. See his full profile and disclosure of his industry affiliations.

Link: http://theitsecurityattache.com

Good day to you,

Every day I talk with people across all vertical markets, business sizes, organizations and cultures about the IT Security issues being faced in our world today and how it impacts our everyday lives, and it is becoming one of those awakening kind of issues for many. Whether they like it or not, they know they are affected in one way or another. While most people tend to try and figure out if and where they fit into this Matrix, the recent mass media explosion of the Conficker worm created somewhat of a sense of understanding as many now saw it from a non technical aspect and as what it really is, a people problem.

As a security attaché, I have relayed this message of IT Security being a people problem and not an industry one for years but it doesn’t resonate well for many because they didn’t understand the matrix and how it worked. Now that they saw and heard of it on the TV (which is an even bigger influencer on people today), the same things we IT people have been trying to tell them now makes some kind of sense. Let us take away the fact that whether the media coverage on the TV was doing much justice or help for the issue(s), it did add a well needed visibility to the scope of the problem and that was very well needed today. It would be nice if we say a segment on the news specific to The IT Security Threats Landscape ~TITSTL~ and issues in and around it. They could bring in some professionals in the field to talk about the issues and what is going on and how people can protect themselves in it. That would be a well needed thing to see at that level today as we are going into this vast technology future of ours which we’re taking head on without looking at the real implications and effects of it.

The logic behind the issue is simple, because your system(s) are up and running and have not been wiped out nor shut down by a threat doesn’t mean it is safe, secure or threat free. In many of my health assessments I have shown the owner my findings of worms, trojans and other blended threats that are sitting on their systems because of lack of proper security solutions to protect them or the improper configuration of the solution being used. The fact that they are there is one thing, what they are doing is something else and both are critical issues to ponder.

While many will refute this fact, I have seen, worked and handled enough of these cases to state as a fact that many fall into this area of The IT Security Threats Landscape. A resident rootkit, keylogger, worm or whatever the variant may be, is actively working its way through your system and causing some form of data loss/theft or compromising the state of applications, connectivity or system stability that we security professionals deem critical. Here is another way to look at this.

If you went to the doctor for a cough that has been bugging you for a while and he says to you, you have a chest or respiratory infection would you tell him no?
If he says to you that you need antibiotics and some cold medicine do you tell him no?
Why not?
Because, this is his field of expertise and study and as such he can make this assessment based on his knowledge of the issue and the facts he has from testing you.
Are you a medical person to dispute his statement and will you seek a second opinion from someone else?

The fact that you’re still alive and well (somewhat, depending on how you define well) does not negate the reality of the issue that you are infected with something that is causing some kind of issue/effect on the body resulting in that cough which in our field of IT we would call an early warning. So, this is the same way in which we look at the IT Security issues of today and how people tend not to look at it. They haven’t gotten that early warning of a cough because the system hasn’t picked up on it yet and when it does happen, because they have not fallen and can’t get up this is not a critical issue. The system becoming slow and unresponsive is that early warning and at that stage most people tend to seek professional help depending on the need/use of the system and how critical it may be for business or even personal use.

So here we stand dealing with people who are harvesters of thousands of people’s information and things about them (whether you know or like it) and they rest idle to this decadent behavior and mindset. Yet, unchecked, their systems sit comfortably hosting these blended threats which are sending/stealing critical private, personal, financial data/information to these hackers unbeknownst to them. The careless whisper of ignorance to these issues is the driving force behind the growing success of such threats today. A hacker have so much more to gain from you giving it to them than for them having to go through getting it from you and is why the botnet issue is such a growing one today. The use of keygens, crack files, peer to peer (P2P), unpatched applications and systems makes it so much easier to exploit what is available that one tends to wonder when and where does it end. It ends with user education and awareness on and about the threats landscape and what these issues are. It end when people start taking this seriously and realizes that you’re just as much a victim as anyone anywhere if you’re not protected properly.

It ends when you stop saying I have anti-virus protection and so i’m ok when you know you haven’ renewed that subscription over six months ago and so you’re missing all the latest and greatest signature based protection that it should provide. Anti-virus alone CANNOT protect you from the threats out there today, it has to be a layered approach where various solutions are in play to cover the needed layers.
It ends when you wake up from this illusion that my OS is more secure than the other and so I don’t have to worry about these security issues.
It ends when we stop underestimating the knowledge of your youths and start educating them much early on the proper use of the internet and the functions and features of it. IT Security must be a part of the school curriculum today as technology is our future for tomorrow and they are our next generation of professionals and leaders.
It ends when you start accepting the fact that you are as much a risk to me as I am to you if we’re not practicing basic IT Security best practices.
It ends when you stop taking the cheap way out of operating a business when hosting people’s private and confidential information which is priceless to them and they trust you to keep it secure. Have some respect for your customers and let them rest comfortable knowing that you have their best interests at heart in properly protecting your infrastructure.
It ends when you realize that these threats are released in the wild with no specific targets but the system(s) you’re using which unfortunately is in the homes, schools, workplaces and places of general interest.

The treats are not specific to government and their systems. It is not specific to the private or public sectors. It is not specific to the educational institutions and it certainly isn’t targeting the healthcare sector only. All are affected and are in the path of these threats because, they are all sharing the same interconnectivity transport medium, the internet and the internet respects no one and has no boundaries.

It is time that people take this as a basic part of their lives where one does not get consumed on questioning the validity or severity of the threat but questioning the readiness of themselves and their systems to face them. While our government may understand the real scope of these issues, their efforts to create effective management and policies to protect the country’s infrastructure are missing critical elements, the people and the roles they play in strengthening the protective layers or being a weak link and point of entry/compromise for what is being implemented. Unless we strengthen the people through education and awareness they will always be a weak link in the chain of protection.

When a company is hacked or they lose their data by whatever means there is, who suffers the most, the employees, the end users. The company suffers a data loss or has a breach but the actual data may be your private and confidential information. Even if the company loses its financial data, it has a much better recovery rate through insurance and such than an individual who now suffers from the loss of privacy and here in the US, credit ratings.

Think about the many places that have information about you that you consider to be private and confidential. Your employer has your social security info (and possibly family members who are covered by you), some financial info for direct depositing of your paychecks. Your 401K info. Health and life insurance info.
Your doctor has your private health records and, results. They have your family’s private info as well as some kind of visit may have been had over the years and that info is in the system.
Your bank has all your financial info and records. They may have your mortgage info as well (if you own a home). The car loan and all the info in it. Student loans and the works.

So think on these things and when you look at all of them, who is most affected in the event of a data loss or breach at any one of those kinds of organizations or businesses, you, the end user, consumer, employee.

IT Security is a people problem and must be dealt with accordingly. It is not about selling security, it’s about creating greater education and awareness about it so we can all contribute towards upholding the strengths of the protective security layers that are there for our protection.

Stop asking if this is real, ask yourself, how do I protect myself, my family, my business, my country from these elements and there effects. This is REAL.

When in doubt, reach out.

~Brett A. Scudder~
The IT Security Attaché

Link: http://theitsecurityattache.com/blogs/2009/04/03/off-to-i-con-for-a-fun-filled-weekend-and-to-meet-samwise-gamgee-from-lotr-oh-great-it%e2%80%99s-raining/

Hi all,

Off we go.

http://theitsecurityattache.com/blogs/2009/04/03/off-to-i-con-for-a-fun-filled-weekend-and-to-meet-samwise-gamgee-from-lotr-oh-great-it%e2%80%99s-raining/

Have a great weekend all.

~Brett A. Scudder~

Link: http://titssn.net

Good day to you,

Over the past year I have been looking for a service that would allow us to create a centralized alerting system for critical security related news, alerts, notices and inter-network happenings (meetings, events, workshops). I have been studying the Twitter network and its growth, usability and service capabilities and I must say that I am very impressed by its sheer simplicity but extensive use and features. As the fastest growing social network today, Twitter allows the ease of signing up, connecting to other Twitter members, activating the SMS device notifications and the use of short text based updates.

This presents a number of possibilities that we can use to build a global alerting system that will aggregate all the various places where threat notification and alerts are being disseminated and channel them into our own system through Twitter. As a network of professionals, business executives and people of influence with high responsibility for critical infrastructures, we need a system that will allow the instant option of opting in and out of alerts and activating the mobile alerting system. It also needs to allow two way communications between the system and those who subscribe to it so in the event of something critical happening, we can have up-to-the-minute updates coming on from anyone anywhere.

For these reasons we have decided to use the Twitter network as our alerting and notification system for IT Security related outbreaks, threats and notices. It will also serve as a notification system for our events, meetings and happenings. Two separate accounts have been created to manage these alerts/notices.

Effective April 1st 2009, TITSSN’s ITSecureAlerts and TITSSNHappening have been activated as a part of the TITSSN v.2010 network upgrade.

Over the past few days we have experienced a heightened sense of alert and awareness from the Conficker worm and its pending effects on the target date of April 1st. There was such a need for pertinent development info and updates as the target day drew nearer, and even on the day that people were reaching out for any kind of heads up they could get, they were coming in from all over. Now we’re able to capture these and have them sent out in a prudent managed fashion. All future alerts and updates on such issues will be handled by the IT Security Alerts (ITSecureAlerts) notification system which will monitor the development and progress of these kinds of threats and post pertinent info for its followers.

TITSSNHappening will broadcast our event updates and happenings and will always maintain the current info for whatever is coming next from the network.

Please follow accordingly and help to spread the word to anyone who wants to be kept in the know in the event of such critical IT Security issues. We may not always have the luxury of time on our hands but we can have the luxury of a working system of alerts and collaboration in times of need.

Thank you very much and have a great day. We apprecilove your business and support and look forward to serving you more.

~Brett A. Scudder~
The IT Security Attaché | http://theitsecurityattache.com | Blogs http://theitsecurityattache.com/blogs
President/CEO/Chairman/Founder/Security Architect
~TITSSN ~The IT Security Suite Network~ | http://titssn.net | TITSSN’s Blogs http://titssn.net/blogs
Brett.Scudder@titssn.net (877) 539-8614 / (718) 928-6516
We are Security - your Security - our Security - IT Security. Our Security is Safe and Secure.
A Managed Security Services/Value Added Resellers Provider (MSS/VAR-P)
My LinkedIn profile - http://www.linkedin.com/in/titssn | TITSSN’s IT Security Forum Board http://titssn.net/forum
Follow me on Twitter http://twitter.com/TITSSN | Facebook http://www.facebook.com/people/Brett-A-Scudder/1161704997

Link: http://theitsecurityattache.com/blogs/2009/04/01/govt-may-track-all-uk-facebook-traffic/

Gov’t may track all UK Facebook traffic
18 Mar 2009 13:41 | http://news.zdnet.co.uk/security/0,1000000189,39629479,00.htm

Home Office minister Vernon Coaker has said the government is considering recording the traffic data of all UK citizens on social-networking sites, including Facebook, MySpace and Bebo

The UK government is considering the mass surveillance and retention of all user communications on social-networking sites including Facebook, MySpace, and Bebo.

Home Office security minister Vernon Coaker said on Monday that the EU Data Retention Directive, under which ISPs must store communications data for 12 months, does not go far enough. Communications such as those on social networking sites and instant messaging could also be monitored, he said.

“Social-networking sites, such as MySpace or Bebo, are not covered by the directive,” said Coaker, speaking at a meeting of the House of Commons Fourth Delegated Legislation Committee. “That is one reason why the government are looking at what we should do about the Intercept Modernisation Programme, because there are certain aspects of communications which are not covered by the directive.”

Under the EU Data Retention Directive, from the 15 March, 2009, all UK internet service providers (ISPs) are required to store customer traffic data for a year. The Intercept Modernisation Programme (IMP) is a government proposal, introduced last year, for legislation to use mass monitoring of traffic data as an anti-terrorism tool. The IMP has two strands: that the government use deep packet inspection to monitor the web communications of all UK citizens; and that all of the traffic data relating to those communications are stored in a centralised government database.

The UK government has previously said that communications interception was “vital”, and has hinted that social-networking sites may be put under surveillance. However, responding to a question from Liberal Democrat MP Tom Brake, Coaker said that all traffic data on social-networking sites and through instant messaging may be harvested and stored.

“The honourable member for Carshalton and Wallington will also know the controversy that currently surrounds the Intercept Modernisation Programme,” said Coaker. “I look forward to his support when we present Intercept Modernisation Programme proposals, which may include requiring the retention of data on Facebook, Bebo, MySpace and all other similar sites.”

Deep packet inspection, the second strand of the IMP, involves intercepting and examining the contents of all data packets that flow over a network. In Monday’s meeting, Coaker said the government still intends to have a consultation on whether to inspect and then store all internet traffic data in a centralised government database.

“What is the point of having a consultation if, as the honourable gentleman implies, the government have already made up their mind to have a central database?” said Coaker. “We have not made up our mind. We have said we will consult on a variety of options.”
Opposition to the government’s IMP proposal has been fierce. Cambridge University computer security expert Richard Clayton told ZDNet UK on Wednesday that the government proposal to monitor social-networking traffic was “extremely intrusive”.

“The question is whether it’s necessary or proportionate, and the short answer is no, it doesn’t look that way,” said Clayton. “If the government wants to make us safer, having a few more police on the electronic beat would be a good idea.”

Clayton said that the problem for the government is that the Data Retention Directive only applies to data held by internet service providers, but that a large number of people don’t use ISPs’ systems to communicate, instead using online services including webmail and social-networking sites. Servers may be located in different jurisdictions, said Clayton, and data-retention times may be short.

“The government wants to collect all of this data on everybody, just in case,” said Clayton. “Suppose you use hotmail.pk, and you blow up the Houses of Parliament. The government would have to persuade the Pakistani authorities to turn over the logs, which may then turn out only to have been retained for three days.”

However, Clayton believes that the cost of harvesting this information, which would involve all UK internet infrastructure providers and ISPs having ‘black boxes’ to monitor data, would be prohibitively expensive. Clayton said that taxpayers’ money would be better spent on the police, who could target investigations to those they suspect of criminal activity, rather than on performing blanket surveillance of everybody.

“To deploy deep packet inspection equipment isn’t cheap — the word ‘billion’ is appropriate,” said Clayton. “It took the Home Office the best part of a year to find £3m for the Police e-Crime Unit. That’s what is wrong with this picture.”

Web inventor Sir Tim Berners-Lee also opposes the use of deep packet inspection to inspect people’s data. Berners-Lee told ZDNet UK last week that the internet should not be “snooped” upon.

“If [third parties] are using the data for political ends or commercial interest, there we have to draw the line,” Berners-Lee said. “There’s a gap between running a successful internet service and looking inside data packets.”

Story URL: http://news.zdnet.co.uk/security/0,1000000189,39629479,00.htm

Copyright © 1995-2009 CNET Networks, Inc. All rights reserved
ZDNET is a registered service mark of CNET Networks, Inc. ZDNET Logo is a service mark of CNET Networks, Inc.

Link: http://theitsecurityattache.com/blogs/2009/04/01/my-first-system-refresh-for-2009-how-often-do-you-refresh-yours/

Greetings,

It’s that time of the year again and now I have more of a challenge this year as I have more systems to refresh. Every 2-3 months I do a complete system wipe and rebuild of my primary systems (now 16) to give them a clean start and a fresh look and feel. During the year I test so many products and solutions from the industry and once I have tested and like something, it gets added to my approved applications list and is allowed to be installed on my primary systems. It also give me a fresh build as I get rid of old install files or hidden threats that may have been left behind and now the system breathes and runs much better.

These are different from my test boxes that I may refresh daily, weekly or after a few months depending on what i’m testing on it and the period needed to properly deal with it.

As a senior executive on various committees, boards and teams, I take my security practices very seriously as a compromise on my end could lead to mass messaging or some kind of threat coming from my network which could lead to serious issues for my recipients. I am very vigilant about keeping the best of best practices for my organizations infrastructure with regular reviews and updates. As a security professional responsible for numerous organizations infrastructure, I practice these steps to protect myself and those who I collaborate with and the responsibility to protect the people and data in them. One can never be too cautious in this time and age of new and emerging technology and threats and so I try to stay on the cutting edge of the security issues.

So it is that time and my first refresh of which I am somewhat happy for as i’m getting ready to move most of my Vista boxes over to Windows 7. I have been playing around with some new products and solutions and will be moving over to them during this refresh cycle. The timing of this new Conficker worm couldn’t be any worse (or maybe better) as i’m refreshing between March 31st-April 1st. I’m also rolling out a hot new UTM ~Unified Threat Management~ device today as well and I look forward to its protective features and enhancements.

So away I go to start prepping for my refresh and trying to keep up on this Conficker issue which has set me back a day in my schedule.

Thank you and have a great day,

~Brett A. Scudder~
The IT Security Attaché

Link: http://theitsecurityattache.com/blogs/2009/04/01/titssn-takes-on-the-i-con-28-science-and-technology-conference-on-april-3rd-5th-in-brentwood-long-island/

FYI…

TITSSN takes on the I-CON 28 Science and Technology Conference on April 3rd-5th in Brentwood, Long Island
http://theitsecurityattache.com/blogs/2009/04/01/titssn-takes-on-the-i-con-28-science-and-technology-conference-on-april-3rd-5th-in-brentwood-long-island/

Link: http://theitsecurityattache.com/blogs

Hi all,

If your day went like mine then you must be beat, phew, what a week so far.

It’s 3am and i’m scanning the wires, net and blogs to see what’s up with Conficker so far. All is well and from the looks of things you still have time to get those patches loaded, get that anti-virus/anti-malware loaded, configured and run a full/deep scan.

I just completed a full scan of my network and double checked my logs and settings and everything looks ok. We’re still early into the day and so who knows.

For those who are saying it could be a joke/hoax and not preparing for it,
What if it isn’t?
Would you want to be prepared even if it isn’t?

I see that the anti-virus vendors have been busy. Some have released 4-6 new definition updates over the past 12 hrs and that’s a good sign. It means they are still working diligently on helping us stay secure. By the time it hits morning here in the US everyone should be running some April 1st 2009 definitions as I expect there will be at least 1 or 2 within the first 8hrs. If you’re not running with an April 1st def, then make sure you’re at least at March 31st after running an auto update for definitions.

I haven’t slept since Saturday just from prepping for today and helping people get their systems patched, updated and secured but I am surely going to catch a few zzzzzzz in a few.

The day is young, be safe than sorry, patch and secure up and rest well.

Until later when I rise,

The IT Security Attaché