While their cybersecurity czar plans have been delayed for so long we were all a bit tired for waiting, the White House approach to fighting cyber threats seems to have found a new focus these days: recommending training, exams and detailed certification requirements for cybersecurity professionals employed or contracted by the federal government. And this is going through the careful review of a commission whose main purpose is to advise the Obama administration on cybersecurity policy.

The Commission on Cybersecurity for the 44th Presidency, which in December 2008 issued its Securing Cyberspace for the 44th Presidency report to Congress, is currently working on a sequel to that report, due sometime in late June or early July. The commission, made up of a who’s who of experts and policy-makers, is debating strategies for building and developing a skilled cybersecurity workforce for the U.S., as well as issues surrounding an international cybersecurity strategy and online authentication.

Of course, the discussion got a bit stuck in the first part of the future report, the cybersecurity workforce. With no one knowing if the new certification recommendation will take into account existing certifications or not, with people in the commission and in the field of cybersecurity having different takes on the issues, and given the need to details qualification needed for each type of IT security pro, I assume it will take a while to get to a common decision on this one

According to Tom Kellermann, a member of the Commission and vice president of security awareness at Core Security Technologies, the federal government has bigger problems: an insufficient workforce that’s about to shrink some more if certifications become mandatory requirements:

“I would suggest that we need to increase our workforce, but not ostracize those that don’t have certifications to get them or lose their jobs. They should be grandfathered in,” Kellermann says.

Exploring a movie-like scenario, I have to wonder – If they ever want to cut a deal with a genius hacker and have him/her do some anti-hacking work for them, would they care if that person has the required certifications?

As many as 37 percent of German companies were the victim of economic crime in the last three years, a new study has found. Internet fraud and the theft of business secrets have become a particular problem.
The use of USB Flash Drive in high capacity has made it easy to steal even the most complex business or construction plans in just a few seconds.

A USB Thumbdrive is all that’s required to steal valuable information.

A new study carried out by the German research institute Emnid for the financial services firm KPMG has found that criminal methods are being used more and more often in the ruthless and competitive world of business.

The survey, which took in 375 companies of all sizes, found that around one in three companies had been the victim of business crime. Two thirds of the companies surveyed also expected the level of criminality to rise.

The biggest economic crimes remain fraud, theft, embezzlement and breach of trust, but money-laundering and the forgery of accounts and financial information have all risen since the last survey was carried out in 2006.

Ignorance breeds carelessness

According to KPMG spokesman Frank M. Huelsberg, companies still need to be more aware of how crimes operate. “Despite these alarming results, small and medium-sized companies are particularly prone to underestimate the danger of falling victim to crime,” he said.

Fifty-six percent of the employees surveyed said that their company was less likely to be a victim of economic crime than a major corporation, while 76 percent believe they have made adequate security arrangements.

“Privately- or family-owned companies like to put their trust in their employees. But that makes them vulnerable,” Huelsberg said, “Experience shows that basic security mechanisms are often neglected in such companies.”

Third-party threat

In 62 percent of economic crimes involving small and medium-sized companies, employees conspired with an external third party. This figure is only 40 percent with large companies.

The theft of business or operational secrets is a growing threat, according to the study. A third of small and medium-sized companies have been a victim of such theft, the study said.

“The sale of sensitive information to competitors or criminals is particularly strong in times of economic crisis,” Huelsberg says, “Nowadays even the most complex construction plans fit on a USB stick. Data theft and industrial espionage can be child’s play if security fails, and the loss of sensitive designs or formulas can be fatal for a small, innovation-based company.”

Read the enitre article here on DW.

With security journalists complaining about hazy security predictions for 2010, we thought I thought I should get my crystal ball out and share with you what the future holds for the world of Endpoint Security! My predictions are based on what I’ve noticed in the past few years, on recurring issues and generally how things work in the industry. So here goes!

1. The much hyped and awaited US Cybersecurity Czar will spend at least 6 months sorting through inter-agency policies, egos and feeble budgets and only then starting to do some work! The boost the security industry is expecting to come from the authorities interest in cybertheats will continue to lag.

2. The economy is picking up. But slowly and mostly on paper. Security budgets won’t be much increased and cost effectiveness will remain an important factor in selecting security products. Let’s hope it will come into play after the ineffective products are eliminated and not before!

3. While misplaced laptops might not be as big of a cause for security threats – shrinking budgets might put an emphasis on accountability for company technology and hardware and people might start paying more attention to where they through their notebooks – portable hard drives, USB sticks and other such devices will still be grossly lost and left unencrypted. So we’re still up for plenty of news on misplaced hardware leading to humongous sensitive data exposures.

4. I completely agree with the ICSA labs prediction – “Network-attached peripheral security threats will continue to increase. With more network-attached devices than ever before, disgruntled employees and other insiders will find ways to use unsecured printers and other network-connected devices to steal data while covering their tracks.“

No surprises there! USB sticks, MP3 players, smart phones, portable hard drives, they’re all hooked to the corporate networks and can pretty much drain all the data out of your company. With people still being let go and the competition willing to do anything for and edge and a chance to survive the dire conditions of a barely recovering economy, the insider threat will continue to lead them all when it comes to data theft.

5. 2010 will be the year of Security as a Service. With so many companies relying on overworked and understaffed IT departments and unwilling to allot too much money to the IT infrastructure, security products offered as a service will all see significant increase. Of course only those that get the job done! Pretty obvious if you think about it: no time wasted on installation and maintenance, no additional hardware needed to accommodate the new software, easy to learn and intuitive interfaces, it makes sense.

6. As a consequence of point 5 up there, companies providing software as a service solutions will have to better explain and promote them. They need to address reliability, liability and other security concerns, as well as point out the many benefits of choosing this type of security service.

7. More lawsuits. Yes, more data breaches will lead to lawsuits. Customers are becoming more knowledgeable, so the lawsuit threat will increase for all companies mishandling private data of their customers. They might not all win, but companies need a better plan to handle breaches. For example, waiting for months to disclose them might not be the sharpest idea.

What do you think? Which of these will come true and which are your own predictions for 2010?

If you’re wondering how many cybersecurity threats a federal agency faces on a daily basis, a new survey has the answer to your question. At least one, each day, every day. About a third of the IT professionals employed by federal agencies say they experience at least one cybersecurity incident each day, be it external attack, malware, lost device, inappropriate employee access, or other threat.

When one thinks that of these 31% at least a few work for the same agencies. Threfore the numbers are troubling. The frequency of such problems are at the same level or slightly higher than last year for most survey respondents, and their severity has remained about the same. The top issues of this year are malware (33% of respondents), inappropriate employee activity or network use (25%), managing access for approved remote users (25%), and data encryption (23%).

As most of the participants find a solution to this problem in acquiring new, better performing cybersecurity solutions, and as many agencies already make efforts to buy such technologies, it comes to no surprise that market research firm Input, quoted by DarkReading,  says federal cybersecurity spending will increase 48% from USD 7.9 billion this year to USD 11.7 billion in 2014. And the shining stars of this future wave of inestments are a USD 1.5 billion cybersecurity data center currently being developed by the National Security Agency and a cybersecurity operations center recently opened by the Department of Homeland Security.