Wednesday, April 29, 2009

For my Computer Security students: What kind of hack is most likely to stimulate legal and regulatory change?

http://www.databreaches.net/?p=3305

WV: Bar association reports hack; members’ personal info at risk

April 28, 2009 by admin Filed under: Hack, Miscellaneous, U.S.

The Associated Press is reporting that the West Virginia State Bar’s web site and network were hacked and that members’ names, mail and e-mail addresses, lawyer identification numbers, and Social Security numbers of some members and former members may be compromised.

The breach was reportedly discovered “recently” and there is no indication as to when the breach may have actually occurred. The site has been offline since April 17 with a note that it is “down for maintenance.”

[From the article:

The Web site was taken offline April 17 and a new one will be built to replace it.



Related. How much of the iceberg is above water? I stopped posting breaches of less that 100,000 unless there is something humorous (or pathetic) about them. There are just too many to bother with.

http://www.identitytheftblog.info/identity-theft/small-breaches-big-consequences/1378

Small breaches can have big consequences

April 28th, 2009 Rob Douglas

Over the course of the last year, the fact that many - perhaps most - data security breaches are going unreported by the majority of data breach reporting organizations and web sites has become very apparent.

… Equally as important, those overlooked “small” breaches are often far more significant than the larger breaches that are reported by data breach monitoring organizations. More often than not, the small, unreported breaches have actual victims who’ve sustained actual losses as compared to many of the larger breaches where it is fairly obvious the missing data will never fall into the wrong hands.

[I suspect this is true only for the very small breaches – those where someone is stealing paper receipts or applications. Bob]



Another consideration is that politicians can deny their cyberwar. No soldiers die, great fleets of ships and planes aren't launched, and it takes only a few people to start the automated attackes (which can be routed through many other countries to confuse things further.)

http://it.slashdot.org/article.pl?sid=09/04/28/205203&from=rss

Should the US Go Offensive In Cyberwarfare?

Posted by kdawson on Tuesday April 28, @04:50PM from the mutually-assured-mayhem dept.

The NYTimes has a piece analyzing the policy discussions in the US around the question of what should be the proper stance towards offensive cyberwarfare. This is a question that the Bush administration wrestled with, before deciding that the outgoing president didn't have the political capital left to grapple with it. The article notes two instances in which President Bush approved the use of offensive cyberattacks; but these were exceptions, and the formation of a general policy was left to the Obama administration.

"Senior Pentagon and military officials also express deep concern that the laws and understanding of armed conflict have not kept current with the challenges of offensive cyberwarfare. Over the decades, a number of limits on action have been accepted — if not always practiced. One is the prohibition against assassinating government leaders. Another is avoiding attacks aimed at civilians. Yet in the cyberworld, where the most vulnerable targets are civilian, there are no such rules or understandings. If a military base is attacked, would it be a proportional, legitimate response to bring down the attacker's power grid if that would also shut down its hospital systems, its air traffic control system, or its banking system?"


Related Where is Pearl Harbor today?

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9131043

The new ground zero in Internet warfare

The power grid is an obvious target for terrorists, but experts disagree about how to secure it

By Julia King

April 27, 2009 (Computerworld) When it comes to critical national infrastructure, the highly distributed and ultra-interconnected U.S. power grid is, hands down, the most vulnerable to cyberattack. On this one point, many cybersecurity experts seem to agree.

Yet just how likely a terrorist target is the grid? And what's the best way to secure and protect the massive inventory of generators, power plants and transmission lines plus the cat's cradle of computer networks that make up the electric power system?

Talk to 10 experts, and you'll likely get 10 different answers.

"The problem is that we have a hard time assessing risk," says Jim Lewis, a senior fellow specializing in cybersecurity at the Center for Strategic and International Studies. "We seem to settle on either indifference or a Bruce Willis movie."



Realistic? It could just be the frustration talking...

http://www.pogowasright.org/article.php?story=20090428192102223

Jail for Data Loss CEOs, Say E-Crime Congress Survey Respondents

Tuesday, April 28 2009 @ 07:21 PM EDT Contributed by: PrivacyNews

An international survey of 104 security professionals conducted by Websense at this year’s e-Crime Congress reveals that 93% of respondents believe companies are under more pressure to protect against data loss due to the current economic climate.

Furthermore, security professionals also unanimously believe that businesses exposing consumers’ confidential data through a serious data breach should be punished for security negligence.

  • Nearly a third (30%) think that CEOs and board members should face imprisonment for exposing consumers’ confidential data, (representing an increase of 5% from last year’s survey)

  • 62% believe companies should be fined

  • 68% call for compensation for consumers affected

Source - PR Wire



Speaking of criminals... Let's talk about ISPs. Qwest still peaks at 20MBPS

http://tech.slashdot.org/article.pl?sid=09/04/28/1628233&from=rss

Cablevision To Offer 101 Mbps Down, No Caps

Posted by kdawson on Tuesday April 28, @01:38PM from the like-a-drug dept.



It only works if they collect the data... Fortunately, they collect everything!

http://www.bespacific.com/mt/archives/021222.html

April 28, 2009

New Google Search Feature Makes It Easier Find and Compare Public Data.

Official Google Blog: "We just launched a new search feature that makes it easy to find and compare public data. So for example, when comparing Santa Clara county data to the national unemployment rate, it becomes clear not only that Santa Clara's peak during 2002-2003 was really dramatic, but also that the recent increase is a bit more drastic than the national rate...if you go to Google.com and type in [unemployment rate] or [population] followed by a U.S. state or county, you will see the most recent estimates..."



Do you, like overuse some like, you know, words like for example, like?

http://tagcrowd.com/

TagCrowd

Author: Daniel - Date: October 6th, 2008

TagCrowd is a web application for visualizing word frequencies in any user-supplied text by creating what is popularly known as a tag cloud or text cloud

No comments: