Five Cryptologists Added to National Security Agency Cryptologic Hall of Honor

Five "cryptologic greats" were inducted into the NSA/CSS Cryptologic Hall of Honor today at the National Cryptologic Museum (NCM). ADM Michael S. Rogers, Commander, U.S. Cyber Command, Director, National Security Agency/Chief, Central Security Service presided over the ceremony and highlighted the distinguished achievements of each of the inductees: Ralph W. Adams, Charles R. Lord, William O. Marks, Robert J. "Mac" McNelis and Virginia Jenkins Riley.

The Hall of Honor was created in 1999 to pay special tribute to the pioneers and heroes who rendered distinguished service to American cryptology. The standards are high for induction into this great hall. The individuals honored were innovators over their entire careers or made major contributions to the structure and processes of American cryptology. The men and women who have been inducted to the Hall of Honor are all greats in the once silent world of cryptology. Through the National Cryptologic School (NCS), NSA offers numerous learning opportunities for intelligence professionals.  Which other candidates for the NSA Cryptologic Hall of Honor would your recommend? Share your comments with the Cloud and Cyber Security Center.


 

The Rise of Cyber Threats in 2016 - What to Expect and Mitigate?

As cyber attacks rise, and government agencies, law enforcement and the private sector all seem powerless to stop them. The list of recent high-profile victims includes such well-known names as Target, Sony and Ashley Madison, and it also includes the Joint Chiefs of Staff and even the White House.

Many of the cyber threats are coming from countries that include China, Iran and North Korea. The U.S. government has budgeted $14B USD for cybersecurity for fiscal year 2016, so clearly, this threat is being taken seriously at the highest levels of government. Unfortunately, security experts expect cyberattacks seen in 2015 to continue in the new year, if only because those most likely to be victimized simply haven't done much to step up security. In fact, many federal agencies have not even instituted two-factor authentication, something as simple as requiring both a card and a PIN number.So which cyber threats do you believe pose the greatest risk in 2016? Send your comments to the Cloud and Cyber Security Center.

Fortinet Introduces Advanced Threat Protection

Fortinet's FortiSandbox is designed to detect and analyze advanced attacks designed to bypass traditional security defenses. In independent NSS Labs testing, FortiSandbox demonstrated 99% Breach Detection effectiveness and due to Fortinet’s unique multi-layered sandbox analysis approach detected the majority of threats within one minute.
FortiSandbox, secured by FortiGuard, offers inspection of all protocols and functions in one appliance. It can integrate with your existing Fortinet infrastructure including Fortigate, FortiMail and FortiClient, fueling a security ecosystem that automatically protects, learns, and improves your overall threat protection. It delivers highly effective protection against advanced persistent threats that is affordable as well as simple and flexible to deploy and manage. Complement your established defenses with this cutting edge sandbox capability; analyzing files in a contained environment to identify previously unknown threats and uncovering the full attack lifecycle. How does the Fortinet ATP solution compare to competitive offers by Cisco, FireEye, PAN and related vendors? Share your comments with the Cloud and Cyber Security Center.

FireEye Introduces Mobile Threat Prevention (MTP) for Mobile Devices

FireEye Mobile Threat Prevention (MTP) offers real-time visibility of threats on mobile devices, displays play-by-play analysis of suspicious apps, provides an index of pre-analyzed apps, and generates threat assessments for custom apps. FireEye Mobile Threat Prevention also leverages the broad FireEye ecosystem by exchanging threat intelligence through the FireEye Dynamic Threat Intelligence™ (DTI) cloud. FireEye Mobile MVX engine detects unknown threats FireEye Mobile Threat Prevention (MTP) is powered by the MVX engine. Rather than relying on binary signatures, the MVX engine detonates apps  within instrumented virtual Android and iOS mobile environments.

With this dynamic analysis, the MVX engine examines various malware parameters. And using contextual correlation—connecting disparate actions for a full picture of the app’s intent— it flags suspicious behaviors. This approach makes FireEye

Mobile Threat Prevention resilient to obfuscation, code manipulation, evasion techniques, and ensures it identifies known and unknown threats that other defenses miss. How effective with the new FireEye MTP solution be in protecting business and government entities? Share your comments with the Cloud and Cyber Security Center.

Automated Cloud-Based Testing May Soon Replace Traditional Pen Testing

Non-security professionals achieve high-quality videos and photographs with simple video and photo editing apps on their mobile devices and with services they find on the Web. As a result, neighborhood photography studios are practically extinct. This trend doesn’t mean experienced video editors can’t make a solid living for themselves; rather, the talented and professional ones focus on the business sector since it requires better-quality output.

In fact, not a lot of people are truly qualified to work as penetration testers — well, at least not the best ones. Pen testing is way more than just utilizing cool hacking tools and producing vulnerability reports. Great pen testers have deep knowledge of operating systems, networking, scripting languages and more. They are also eager to learn new approaches and employ the new content that they learn in practice. They combine manual work with automated tools and conduct their testing in iterations, reviewing interim test results to build complicated attacks just like a cybercriminal would. However, many single-shingle security consultants and small companies offer pen testing services. Some base their services solely on the use of one or more hacking tools and produce attractive-looking reports that detail all the issues they were able to find. Instead, their results are based only on the tools they learned to operate and not on any specialized skills, which means that their customers could feasibly automate testing and save time and money by doing it themselves. So will this trend continue? Share your comments with the Cloud and Cyber Security Center.

ProofPoint Launches New Cyber Threat Protection Solution

Attackers are constantly changing their tactics and developing more sophisticated advanced threats.  Now more than ever, organizations need full lifecycle protection against targeted attacks and advanced persistent threats. Proofpoint combines its industry leading secure e-mail gateway with sophisticated dynamic malware analysis, real-time threat intelligence and automated threat response. The cutting-edge combination enables organizations to more effectively detect and block targeted attacks, then quickly respond when a potential compromise has been detected.
Proofpoint’s Targeted Attack Protection (TAP) solution delivers advanced malware detection for both URL-based attacks and attachment attacks. Advanced analysis technologies like statistical analysis (big data), pre-exploit indicator detection, advanced sandboxing and static analysis are just some of the techniques employed by TAP to detect advanced threats. Proofpoint’s Threat Response solution provides a single pane of glass for security teams to review and investigate detected threats. With support for a variety of detection vendors, including malware sandboxing solutions and SIEM, analysts can focus their time on assessing the threat and impact rather than collecting data to review. Built-in workflows support rapid containment activities like blocking CNC traffic and isolating infected machines off the network. How effective will the ProofPoint's solution be in combating cyber threats? Share your comments with the Cloud and Cyber Security Center.

The Future of Cloud-Based Security Solutions - Secure or Unsecure?

Hackers and antivirus makers were put on notice last week when two shining stars in the $67 billion worldwide cyber-security universe announced their merger. Milpitas, Calif.-based global network security company FireEye has acquired Washington, D.C.-based cyber-security firm Mandiant. FireEye’s cloud-based systems work differently than traditional — and declining — antiviruses, which look for known cyber-threats that have already struck other targets.

FireEye solutions quarantine inbound traffic, scanning for shady characters, be they from hackers, competitors or even nation states. “Documents [released to the public by Edward Snowden] have made it evident to companies that the United States monitors allies as well as adversaries, including friendly governments, international organizations and the networks of some Internet companies,” The New York Times stated last week. “Some of them could turn to companies like FireEye and Mandiant for protection, an interesting twist since many of Mandiant’s employees come out of the American intelligence world.” What is the fate of cloud-based security? Share your comments with the Cloud and Cyber Security Center.

Gemalto and Other Cyber Threats Pose Challenges for Corporate & Government IT Staff

Last year was a big one for high-profile cybercrime, from the Heartbleed bug to major corporate attacks, and Sony's massive hack. Symantec's analysis of security threats in 2014 revealed thieves are working faster than companies can defend themselves, and launching more malicious attacks than in previous years. More than 317 million new pieces of malware - computer viruses or other malicious software -- were created last year. That means nearly one million new threats were released each day. But hackers actually relied on incredibly old computer bugs that companies just haven't gotten around to fixing yet, according to Verizon's 2015 Data Breach Investigations Report. In nearly 90% of cases, hackers relied on computer bugs that have been around since 2002. The third most popular option for hackers is a glitch in the way an IT manager remotely manages corporate PCs -- one that's existed since 1999. Companies could and should be patching this stuff, but they don't.

"While it seems like a no brainer for fix some of these things, organizations care more about making widgets," said Verizon security data scientist Bob Rudis. "They just don't have the manpower or time." Directed attacks and data breaches also grew, according to Symantec. Five out of six large companies were targeted by cybercriminals, a 40% rise on the previous year. The mining industry was the world's most targeted sector. Samir Kapuria, a Symantec executive, recalled one case in which hackers snuck into an energy company's computer network and stole a draft report. The report detailed the secret discovery of a potentially lucrative energy drilling spot. What is the threat landscape for Q4 2015? Share your comments with the Cyber and Cloud Security Center.

Boston University Offers Cutting-Edge Education on Cyber Security

IT security professionals today play an increasingly critical role in protecting an organization’s infrastructure and mitigating risks to its data. Take this program to learn comprehensive security strategy combining defenses and countermeasures with the goal of preventing significant damage to IT resources. With the Bureau of Labor Statistics predicting that jobs within IT security are expected to increase 22 percent by 2020, now is the time to earn a distinguished credential through BU’s Master of Science in Computer Information Systems online program with a concentration in Cyber Security.

Boston University offer a master’s degree online in 10 courses. BU’s curriculum covers a collection of advanced information security topics relevant to the Certified Information Systems Security Professionals (CISSP) certification and beyond. BU’s coursework expands on the common CISSP framework to fully integrate theory, technology, and the management of technology. Learn how to develop IT security policies and procedures within a governance framework that minimizes organizational security risks. Just how valuable will such courses be in preparing a new generation of cyber security professionals? Share your comments with the Cloud and Cyber Security Center.

NTrepid Introduces New Passages Secure Virtual Browser

The technologies and components in Passages are proven and mature, having evolved from the hardened Internet platforms Ntrepid developed over the last 15 years for the national security community. They put our solutions to the test against some of the world’s most sophisticated and aggressive opponents. Corporate security breaches come through the web because conventional malware protection and firewalls are not enough. The solution is malware isolation. Contain and eliminate web-delivered malware with Passages, protecting your valuable data and infrastructure.

NTrepid's monthly subscription fee per user ranges from $14.99-$34.99. Highly targeted attacks are the new favorite technique of sophisticated hackers, but they can’t target people or corporations that they can’t identify. Hide your IP address and identifying information to avoid these dangerous attacks. Every action on the web is logged, analyzed, and tied back to your business. When your activity is related to confidential plans or information, you risk exposing that to the websites you visit and any advertisers present through passive information leakage. Protect your valuable information with Passages so sites don’t know who you are unless you tell them.How effective will the Passages browser be in detecting and preventing malware attacks? Share your comments with the Cloud and Cyber Security Center.

Norse Intelligence Service Purports to Provide Intelligence About Security Breaches

The new Intelligence Service from Norse claims to provide organizations with the ability to proactively detect and mitigate cyber security threats. Get notified instantly when suspicious or malicious traffic emanates from your network and your partners’ networks. Features include: Discover attack vectors, root causes, and threat actors attacking your organization with Norse fusion counter intelligence analysts, view live attacks emanating from compromised systems on your network with a custom Norse attack map. Norse Intelligence Service combines an automated, globally distributed network of intelligent attack sensors – the Norse Intelligence Network – and actuarial-based risk scoring with human counterintelligence expertise.

Norse sensors and automated crawlers discover early signs of network compromise & provide real time alerts Norse fusion analysts are available to help triage compromises and support incident response.Weekly, monthly, and quarterly reports are delivered to keep you abreast of current issues and trends from your network. A web portal enables your analysts to keep track of events, do further investigation, and access Norse analyst notes. Alerts you of malicious or suspicious traffic from your network as well as your partners’ networks.Norse Intelligence Service is a first-of-its-kind compromise monitoring service and provides early warning to prevent extensive damage to reputation, brand, and intellectual property. It utilizes Norse Fusion Intelligence, a unique and robust combination of automatically gathered intelligence and deep analysis from Norse counterintelligence analysts. The Intelligence Service drastically reduces time to discover and respond, and provides live data so you can take action now to eliminate the compromise and protect your business. How valuable will the Norse Intelligence Service be in proactively preventing security breaches? Send your comments to the Cloud and Cyber Security Center.

FireEye Introduces Adaptive Defense Solution

Cyber security is more than technology. As cyber attacks change, our defenses must evolve. Today's security architecture must be agile, flexible, and deeply integrated. It must offer a far-reaching view of threats to prevent attacks and avert their worst effects.  Most defenses focus on only one or two of these features. They miss most attacks. When they do detect a data breach, they can do little to fix it. Today's architecture must continuously detect, prevent, analyze, and respond to threats.

Adaptive Defense constantly evolves. It learns and improves to deal with new cyber threats. It conforms to your evolving needs. And it offers flexible purchase options to fit your accounting model. Cover one threat vector or all of them with FireEye Threat Prevention Platforms– and scale as conditions change. Manage FireEye deployments yourself or partner with FireEye as a Service for outside expertise. And choose how much you want to know about attackers with three levels of FireEye Threat Intelligence. So will this new Adaptive Defense model effectively work with today's businesses and government agencies? Share your comments with the Cyber and Threat Defense Center.

Cyber Crime: The 24x7x365 Threat Continues to Evolve

No organization is immune to cyber crime. A frequently raised point is that no business can afford to ignore cyber crime, which is estimated to cost the global economy around $445b USD a year. The losses are both direct and indirect, with many businesses citing downtime or lost productivity as a costly side-effect of some cyber criminal activity.
The reality is that every business connected to the internet can expect to fall victim to cyber crime at some point as criminals expand their ability to steal money directly or to turn stolen data into money. The problem is that, while most information security experts are aware of the threat cyber crimes poses to the business, senior executives are often unaware of the scale of the problem. Despite increased media coverage of high-profile breaches, many top executives still believe their organization has no valuable data and will not be targeted. How secure are public and private sector organizations? Send your comments to the Cloud and Cyber Security Center.

Calculating the Number and Cost of Data Breaches to US Businesses

Number of compromised data records in selected data breaches as of August 2015This statistic presents a selection of the biggest online data breaches worldwide as of August 2015, ranked by number of records stolen. In 2011, Sony's PlayStation Network and Qriocity music service were attacked by hacking collective Lulzsec. 

The PSN was offline for more than 43 days and 77 million data records were stolen. See what data leaves the network and gain visibility into how your sensitive information is being used. Identify and fix existing broken business processes and reduce the risk of a data breach. Build and deploy DLP policies faster and more accurately without guesswork or trial and error. Unique, non-invasive capture technology provides visibility on how data is being used and leaked out of your organization. Leverage flexible file tagging to set up time-saving data security policies based on location and application types. Data classification technology categorizes large amounts of data so only relevant files are examined and remediated. So what is the cost to US business for a typical data breach? Share your comments with the Cloud and Cyber Security Center.

ISSA Annual Conference - Preview (October 12-13 - Chicago)

The ISSA International Conference will hold its annual conference October 12-13 in Chicago, Illinois. ISSA offers unique guidance and resources that were carefully selected to help security professionals at all levels to achieve this strategic mix of knowledge, skills, and aptitudes. It also provides access to the strongest global network of experts across industries and skill sets. Join us to transform your career and your organizations.

Keynote speakers will include Vinton G. Cerf, Vice President and Chief Internet Evangelist Google and Daniel Earl Geer, Jr., Sc.D. from In-Q-Tel--and many more experts--at the ISSA 2015 International Conference. Help ISSA advance the culture--join ISSA members and your other colleagues in Advancing the Culture of Security, while shaping your own advancement. This is your premier opportunity to obtain critical education with dozens of breakout sessions—earn up to 18 CPEs. Test drive state-of-the-art products and services in the exhibit hall—experience featured product presentations, reception and other sponsor activities. Develop your career at supportive special interest group meetings and networking events. Which key topics do you believe should be addressed at this year's conference? Send your comments to the Cloud and Cyber Security Center.






Images: https://www.google.com/search?q=cyber+security+products+news+news+vendors&tbm=isch&tbo=u&source=univ&sa=X&ved=0CHgQ7AlqFQoTCLGU5v77sMgCFY01iAodCdcMZg&biw=1680&bih=941

Mastercard to Replace Conventional IDs and Passwords with Biometric Security

Biometrics have long been thought to be a critical solution to conventional ID and Password security. The MasterCard Identity Check will let people make purchases online by taking a selfie and blinking rather than entering a password. It will be first available to financial institutions across the U.S. by mid-2016, followed by a global roll-out in 2017. “Today, people shop on all sorts of devices, and they expect technology to simplify and secure the transaction,” said Ajay Bhalla, president of Enterprise Security Solutions, MasterCard. “This is exactly what Identity Check delivers.”

 According to a MasterCard survey that was conducted between August 13 and 21, 2015 by Norstat, 53 percent of shoppers forget crucial passwords more than once a week, losing more than 10 minutes when they reset their accounts. As a result, more than a third of people abandon an online purchase, while six in 10 said it led to missing a time-sensitive transaction like buying concert tickets. More than half of people want to see passwords replaced by something more convenient, while continuing to deliver the same levels of protection and peace of mind. Will this transition provide enhanced security for credit card users? Send your comments to the Cloud and Cyber Security Center.

The Home and Computer Security Superstore is Now Open For Business

The Home and Computer Security Superstore offers businesses and consumers worldwide a robust selection of Malware, Atni-Virus and Internet Security Software, Home Security and Surveillance Systems and Auto-Vehicle Security products as well.

We carry products from the top manufactures around the globe including ADT, Xfinity Home, Norton, McAfee, Kasperky Labs, TrendMicro, BitDefender, Viper, Bullguard and many more. Visit us at www.homecomputersecuritysuperstore.com

Intellectual Property Crime on the Rise According to the National Crime Agency

Intellectual property crime is committed when someone manufactures, sells or distributes counterfeit or pirated goods for commercial gain. It is estimated to cost the economy at least £1.3 billion per year in lost profits and taxes (Intellectual Property Crime Report 2013/14) but it is difficult to give a precise figure on the scale. The majority of counterfeit goods still originate from China and the increasing use of the internet, particularly social media sites, has created a wide-reaching marketplace to facilitate the sale of counterfeit goods.
The type of counterfeit and pirated goods being produced and sold to consumers are many and varied, but generally they fall into the following categories: 1) Optical Digital media, such as software and games, 2 Luxury clothing, footwear and accessories, and 3) Automotive parts, electrical items and other manufactured goods. Counterfeiting and distributing these goods requires different levels of expertise or techniques and attracts criminals of all types. For organised criminals, it is attractive because it offers a high financial return from, typically, a low investment. Just how serious is the IP security threat? Send your comments to the Cloud and Cyber Security Center.

ThreatScape Intelligence Delivers New Security and Risk Management API with SDK

A large and growing list of security vendors have already developed out of the box integrations using ThreatScape® API & SDK. Whether you want to enrich existing tools and processes, implement new intelligence-driven solutions or integrate intelligence into your homegrown system, we’ve got you covered.

ThreatScape API leverages REST and the SDK supports C, C++, C#, Perl & Python and runs on commonly used versions of Windows, RHEL. ThreatScape API & SDK provide machine-to-machine-integration with the most contextually rich threat intelligence data available in the market today. The API and SDK provide automated access to much more than indicators of compromise (IOC) – the IP addresses and domain names bad guys are using to launch attacks or control compromised systems or the file hashes that can identify malware. With ThreatScape API & SDK you have instant access to IOCs connected to rich context so you can understand the who, what, why and even how behind security events. The average organization generates thousands of security events every day but only has the human resources to investigate a few. How do you know which events to focus on? With ThreatScape API &SDK you can match IOCs with events in your SIEM or security analytics platforms, cut through the noise and automate the prioritization of the events that warrant scrutiny. You can also drastically accelerate triage with context that helps you understand what you are facing. Are you dealing with cyber crime or espionage? Is this threat targeting our industry or is this likely “overspray” from a campaign targeting others? Share your thoughts about this new solution with the Cloud and Cyber Security Center.