Supreme Court Declines Music Download Case

The Supreme Court is declining to decide whether downloading a song is a public performance requiring artists to get paid additional royalties.

The American Society of Composers, Authors and Publishers, known as ASCAP, asked the justices to review a lower court decision that said downloading songs from iTunes, Amazon, eMusic or even music-sharing services do not count as public performances, and hence additional royalties are unwarranted. On Monday, the court let stand that decision without comment.

The group, with 400,000 members, maintained in its petition to the justices that the Copyright Act demanded the extra royalties, which could amount to tens of millions of dollars in extra revenue annually. The appeals court said that downloading a music file is more aptly characterized as “reproducing” that file, and not subject to performance rights.

The 2nd U.S. Circuit Court of appeals, ruling against ASCAP, said “perform,” as outlined in Section 101 of the Copyright Act, means to “recite, render, play, dance or act it either directly or by means of any device or process.”

ASCAP licenses the right to perform publicly the musical works of its members to a diverse array of music users, including internet and network-based sites and services, television and radio stations, restaurants, hotels and sports arenas.

The artists, represented by Theodore Olson, a former U.S. solicitor general, told the justices in their petition that the case was of “vital importance.” (.pdf)

“If the Second Circuits decision stands, songwriters and music publishers across the nation will be denied their statutory right to receive royalties for public performanceswhen their works are downloaded over the internet — which is already one of the most prevalent means for the dissemination of copyrighted musical works,” Olson wrote.

The government, backed by Solicitor General Donald Verrilli Jr., a former Recording Industry Association of America attorney, urged the justices to reject ASCAP’s petition.

“Because the download itself involves no dancing, acting, reciting, rendering, or playing of the musical work encoded in the digital transmission, it is not a performance of that work,” the government wrote the justices.

See SCOTUSblog for documents in the case.

Photo: Phil Dokas/Flickr

See Also:

• ASCAP Assails Free-Culture, Digital-Rights Groups
• Judge: Cellphone Ringtones Are Not Concerts
• ASCAP Cracks Down on 26 Venues for Playing Music without a License
• ASCAPs Webcasting/Mobile Revenue Up 70%
• Does Government Owe Royalties on Torture Music?
• Does Music on Second Life Infringe Copyright?

IBM, McAfee add SIEM security capabilities with acquisitions

IBM and McAfee both made moves Tuesday to acquire security information event management (SIEM)technology, with plans to integrate the reporting and eventcorrelation capabilities into their product lines.

This is further evidence that SIEM vendors have proven themselves ... Theyre creating revenuebased on compliance mandates and so far there doesnt seem to be an end in sight for the growthcurve.

Andrew Hay, senior security analyst, The 451 Group

Big Blue announced plans to acquire Waltham, Mass.-based Q1 Labs and integrate it into a newlyformed IBM Security Systems Division led by Q1 Labs CEO Brendan Hannigan. IBM said the Q1 Labs SIEMsecurity analytics and correlation technology can detect and flag potential security policyproblems to help prevent security breaches. Financial terms of the deal have not beendisclosed.

Meanwhile, Santa Clara, Calif-based McAfee announced it agreed to acquire Portsmouth, N.H.-basedSIEM vendor NitroSecurity Inc. McAfee indicated that following the completion of the acquisition,it will combine NitroSecuritys technology with its own enterprise security management technologiesto help customers asses network and endpoint vulnerabilities. Terms of the acquisition were notannounced.

According to Stamford, Conn.-based IT research firm Gartner Inc., the SIEM market grew 15% lastyear, from $858 million in revenue to $987 million. The SIEM market, which has been characterizedby Gartner and other research firms as being crowded, has been driven by compliance mandates --mainly PCI DSS -- with enterprises deploying SIEM to take advantage of mainly reportingcapabilities. Mark Nicolett, a Gartner Research vice president, said both Q1 Labs and NitroSecurityhad strong technologies and solid customer bases, making them key acquisition targets.  

IBM had SIEM technology in place when it acquired Consul Risk Management and MicromuseGuardedNet, wrapping the capabilities into its Tivoli Security Information and Event Manager. Theacquisition of Q1 Labs may help bolster the Tivoli SIEM weaknesses, or the company could decide tolet Q1 technology stand alone, Nicolett said. They may continue on their merry way and sell [Q1]to customers and then as a side type of activity they would have to figure out how to integrate thestrong, existing technology that they have with the core pieces of Q1 Labs, Nicolettsaid. 

McAfee had been partnering with SIEM vendors before its NitroSecurity acquisition. The companyoffers a set of APIs to enable SIEM vendors to tap into its E-Policy Orchestrator (EPO) centralizedmanagement console. McAfee has had a close relationship with NitroSecurity and shouldnt have adifficult time integrating it into its product portfolio, Nicolett said. Its an exercise inleveraging the parsing and integration APIs that are already part of the product, he said.NitroSecurity also gives McAfee access to potential customers; utilities and other criticalinfrastructure facilities  have been a major part of NitroSecuritys customer base.

While vendors tout event correlation, the vast majority of users indicate they are primarilyusing SIEM for reporting capabilities, said John Kindervag, a senior analyst at Cambridge,Mass.-based Forrester Research Inc.  But security vendors see promise in the broader adoptionof more advanced event correlation capabilities and have been quick to add the technologies totheir portfolios.

The consolidation of the SIEM market gained traction last year, when HPacquired ArcSight for $1.5 billion. Trend Micro and Kaspersky Lab are the only remaining majorsecurity vendors lacking SIEM capabilities, said Andrew Hay, a senior security analyst at The 451Group.  Sophos,which acquired firewall vendor Astaro in May, also picked up log management capabilities fromthe acquisition, Hay said.

This is further evidence that SIEM vendors have proven themselves, Hay said. Theyre creatingrevenue based on compliance mandates and so far there doesnt seem to be an end in sight for thegrowth curve.

~SearchSecurity.com Senior Site Editor Eric Parizo contributed to this report

Software Makers Win Big in Supreme Court Copyright Fight

The Supreme Court is refusing to review a federal appellate panel’s decision that software makers may use shrink-wrap and click-wrap licenses to forbid the transfer or resale of their wares.

Without comment, the justices on Monday let stand a 9th U.S. Circuit Court of Appeals ruling that is another erosion of the so-called “first-sale” doctrine, which the Supreme Court began to chip away at last year.

The first-sale doctrine generally is an affirmative defense to copyright infringement. It usually allows legitimate owners of copyrighted works to resell those copies.

That 3-0 circuit court decision means copyright owners may prohibit the resale of their wares by inserting clauses in their sales agreements. Autodesk had done that with a version of its popular AutoCAD software. The San Rafael, Calif. company sued to enforce those terms in its sales agreement and prevailed.

The Motion Picture Association of America and Software & Information Industry Association, whose members include Google, Adobe, McAfee, Oracle and dozens of others, urged the appellate court to rule as it did.

The American Library Association and eBay argued against that outcome. The library association said it feared that the software industrys licensing practices could be adopted by other copyright owners, including book publishers, record labels and movie studios.

That assertion was not lost on the appeals court. It ruled Congress is free to modify copyright law “if it deems these or other policy considerations require a different approach.”

The 9th Circuit’s ruling last year was believed to be among the first appellate decisions directly addressing whether a user agreement could forbid resales of software. The appellate courts have previously backed companies that have imposed terms on how software may be used.

The 9th Circuit had reversed a lower court judge who ruled the first-sale doctrine applied whenever the consumer is entitled to keep the copy of the work, thus allowing consumers to resell their purchased software at will.

The case concerned Autodesks AutoCAD Release 14, which was for sale on eBay. Autodesk, invoking the Digital Millennium Copyright Act, demanded eBay remove the item from the site, and it promptly did in 2007.

Timothy Vernor, the seller, had purchased at least four copies of the software from a company that was required to dispose of the software under an Autodesk user agreement. Vernor re-posted the sale on eBay and his eBay account was terminated after Autodesk complained. Litigation ensued and the Supreme Court rejected his challenge Monday.

Autodesk imposed a significant number of restrictions on its software: The company required that the software could not be transferred or leased without Autodesks written consent, and the software could not be transferred outside the Western Hemisphere.

The first-sale doctrine of 1909, in its current form, says the “owner of a particular copy” of a copyrighted work may sell or dispose of his copy without the copyright owners authorization.

Last year, the Supreme Court ruled Costco could be liable for copyright infringement for selling foreign-made watches without the manufacturer’s authorization.

Omega, of Switzerland, sued Costco for copyright infringement because Costco was obtaining the watches from unauthorized European dealers that sold them far cheaper than U.S.-based Omega distributors.

Omega copyrighted the watch design in the United States by imprinting the company’s emblem on the underside of the timepiece. The justices upheld a lower court decision saying the first-sale doctrine did not apply to goods produced overseas.

Hat Tip: techdirt

Photo: deltaMike/Flickr

See Also:

• Supreme Court Deciding Whether Congress May Copyright Public Domain Works
• Supreme Court Gets RIAA Copyright Case
• Supreme Court Rules Against First-Sale Copyright Doctrine
• Supreme Court Docket: Surveillance, Profanity and Thought Patents
• High-Court Nominee Mirrors Industry Copyright Stance Update
• Supreme Court Term in Review: Its a Mixed Bag
• Supreme Court Declines Music Download Case

DHS cloud computing: Homeland Securitys model private cloud strategy

The Department of Homeland Security (DHS) has launched a cloudcomputing strategy that could serve as a model for other federal agencies -- especially thosewhose managers are still losing sleep over possible security risks associated with the cloud.

I feel very comfortable that our private cloud services are just as secure as our otherapplications that live within our data centers.

Richard Spires, CIO, Department of Homeland Security

DHS is in the process of establishing private cloud services to manage sensitive data as part ofits effort to consolidate more than 40 data centers into two enterprise data centers at separatelocations. One data center, located at NASAs Stennis Space Center in Mississippi, is managed byComputer Sciences Corp. The other, in Clarksville, Va., is owned and operated by HewlettPackard.

We are hosting our private cloud services out of those two centers, said DHS Chief InformationOfficer Richard Spires. They back up each other so we have redundancy where we need it formission-critical applications. If one were to go down, we could shift mission-critical operationsfrom one to the other.

The DHScloud computing initiative is moving nine different services to its private cloud, includinglegacy email systems, collaboration environments that improve information sharing, andauthentication services across the department.

The departments private cloud model, using two commercially managed data centers -- one ofwhich is located at a government-owned facility -- offers the strong sense of security and controlprovided by a private cloud, but also stands to yield the cost savings expected from a publiccloud.

I feel very comfortable that our private cloud services are just as secure as our otherapplications that live within our data centers and are not part of our private cloud services,Spires said. At the same time, all those services [are] priced as if we went through a publiclybased cloud. So we buy the email on per email box basis, just as if we went to an Amazon orMicrosoft or something on the outside.

In a white paper about cloud computing onthe federal CIO Councils website, Spires said early projections put DHS cost savings at 8% to10% once the transition to private cloud services is complete. Not only does the move to ourprivate cloud model eliminate redundancy and reduce costs, it also bolsters information security,he said.

Spires advised managers at other federal agencies who are migrating applications or services toa private cloud -- or who are considering it -- to work with their chief information securityofficers to integrate security standards into their private cloud services.

What weve done [is to] set up a set of standard controls that have been endorsed by our CISO,Bob West, for our private cloud under Federal Information Security Management Act requirements, hesaid. FISMAclassifies federal systems into low-, medium- and high-risk categories, each levelhaving its own requirements.

A second part of the departments cloud computing strategy involves moving its public-facingwebsites to public clouds over the next few years. Through a General Services Administrationprocurement vehicle, DHS recently awarded its first task order to migrate the departmentsnon-sensitive, public-facing websites to a public cloud provider, Spires said.

We hope to take more advantage of public cloud-based services as we get more comfortable withthe security model and feel comfortable that we can start to migrate some of our sensitive data toa public cloud, he said. Right now, we essentially want to cut our teeth on using our outwardfacing websites since theres no sensitive data on those sites.

Judge Refuses to Sanction CIA for Destroying Torture Tapes

A federal judge won’t hold the CIA in contempt for destroying videotapes of detainee interrogations that included the use of a torture technique known as waterboarding, ruling instead Wednesday that the spy agency merely committed “transgressions” for its failure to abide by his court order.

Punishing the Central Intelligence Agency, U.S. District Judge Alvin Hellerstein of New York ruled, “would serve no beneficial purpose.” (.pdf)

Hellerstein wrote that CIA officials responsible for producing the tapes in a Freedom of Information Act lawsuit might “not have been aware of the videotapes’ existence before they were destroyed.” The judge also said officials who ordered the tapes’ destruction in 2005 might not have been “aware of court orders requiring identification or production of the videotapes.”

The American Civil Liberties Union, which brought the long-running FOIA case and asked for a contempt finding, had requested that Judge Hellerstein order depositions and discovery to ascertain if CIA officials destroyed the 92 videotapes of post-9/11 interrogations of terrorism suspects after they had notice of court orders to produce them.

The judge declined.

“I will not allow additional discovery,” the judge said. He added that the CIA has admitted that some of the videos showed the CIA using waterboarding torture techniques. Footage on one tape, he said, had shown an interrogator who “continuously applied large volumes of water to a cloth that covered the detainee’s mouth and nose.” The Obama administration has declined to prosecute CIA officials for torture, citing legal memos that authorized the techniques.

Hellerstein said because of the tapes’ destruction, the CIA “improved protocols for the retention of records potentially relevant to an investigation or a judicial, congressional, or administrative proceeding.”

The judge said the tapes’ destruction “exposed serious flaws” in the CIA’s document-retention procedures, and he noted that the CIA in August “adopted new document preservation and destruction protocols to insure against similar transgressions in the future.”

Alexander Abdo, an ACLU staff attorney, blasted Hellerstein’s ruling.

“While today’s decision recognizes that the CIA violated a court order when it destroyed the torture tapes, we are profoundly disappointed by the courts unwillingness to label as contempt what it describes as the CIA’s ‘dereliction.’ We also strongly disagree with the courts finding that the CIA has ‘remedied’ the destruction,” Abdo said in a statement. “The truth is that the CIA destroyed evidence of torture, and the destruction of this evidence has made it harder to hold high-level officials accountable for the abuse that they authorized.”

The CIA in 2007 admitted to destroying the tapes of interrogations of alleged al-Qaeda members Abu Zubaydah and Abd al-Rahim al-Nashiri. A special prosecutor last year found that CIA officials should not be charged for the tapes’ destruction.

A year before the tapes were destroyed, Hellerstein ordered the CIA “to produce or identify all responsive documents” in response to the ACLU’s request for “records concerning the treatment of individuals apprehended after September 11, 2001, and held by the United States at military bases or detention facilities outside the United States.”

Hellerstein ordered the CIA to pay the ACLU’s legal expenses.

Photo: Mike Licht, NotionsCapital.com/Flickr

See Also:

• Surveillance, Not Waterboarding, Led to bin Laden
• Navy Commandos Expect Their Shrinks to Be Waterboarded
• Motivational Manager Waterboarded Employee to Spur Sales, Suit Alleges
• Obamas Prisoner Dilemma: Reject Torture, Defend Torturers
• Solitary Confinement: The Invisible Torture
• Torture, Same As It Ever Was
• ACLU Demands Eavesdropping, Torture Memos From White House

Hayden Urges Congress to Let NSA Monitor Public Networks for Threats

Former NSA and CIA Director Michael Hayden at CIA headquarters in Langley, Va., in 2009. (AP Photo/Luis M. Alvarez)

Former NSA and CIA director Michael Hayden revived a controversial meme on Tuesday when he urged Congress to allow his former agency to monitor public networks in order to defend against malicious activity coming from nation states and others.

“We’ve got capability on the sidelines wanting policy guidance,” he told the House Intelligence Committee, referring to the NSA. “And when we can enrich that guidance and get them in the field, the better — the safer — we are.”

Hayden’s remarks echoed what Director of National Intelligence Admiral Dennis Blair told the same committee in 2009 when he said that the NSA, rather than the Department of Homeland Security, which currently oversees cybersecurity issues on government networks and liaisons with the public sector about securing critical infrastructure networks, was the only agency with the skills needed to secure cyberspace.

“The National Security Agency has the greatest repository of cyber talent,” Blair said. “[T]here are some wizards out there at Fort Meade who can do stuff.”

The NSA’s role in the Bush Administrations secret and warrantless domestic spying program, however, has raised concerns among civil libertarians that the agency couldn’t be trusted to monitor networks without violating the privacy of citizens.

Hayden acknowledged to lawmakers that there was “a natural political cultural allergy to letting NSA” monitor private networks, but he said there were ways the spy agency could do so without reading the content of communications or otherwise intruding on the civil liberties of private citizens.

“We want NSA to protect us, but we don’t want NSA out there being present where our own communications are flowing,” he said. “And we’re just going to have to have a serious chat [about that]. I think we can do that — both the technology and the ethic at NSA would allow us to do that. But it will require some convincing before the agency is given that authority.”

Hayden also said there were still some people who didn’t have a proper appreciation of the threat the U.S. was facing from foreign attackers. Speaking about recent spates of attacks on U.S. companies and government agencies that appeared to come from China, Hayden said that “as a professional intelligence officer, I step back in awe at the breadth, depth, sophistication and persistence of the Chinese espionage effort against the United States of America.”

Also appearing before the committee on Tuesday was Art Coviello, executive chairman of RSA Security, which was targeted in a serious attack earlier this year that forced the company to re-issue security tokens to customers after intruders compromised a system used to generate secret codes for RSA SecurID tokens.

Coviello told lawmakers the attack on RSA’s network “could not have been perpetrated by anyone other than a nation state.” He also supported Hayden’s assertion that the NSA should be more involved in protecting U.S. systems.

“We ought to be able to figure out a way for the NSA, which has so much expertise, to work their way in an ethical way to protect us,” he said. “To me its a tragedy that we cant get them more heavily involved working with Homeland Security to a point where they can be more effective protecting American organizations.”

Kevin Mandia, CEO of Mandiant, also spoke at the hearing. Mandia, whose company has investigated numerous headline-making breaches since its founding in 2004, said that in more than 90 percent of the intrusion cases his company has investigated, the victims didnt know they had been breached until a government agency told them them so.

In our last 50 incidents, 48 of the victim companies learned they were breached from the Federal Bureau of Investigation, the Department of Defense or some other third party, Mandia said.

With virtually every other crime, the victim is the first to know that they have been violated,” Mandia said in a prepared statement. “Here, however, we have the government in the unique position of informing victims that they are, in fact, victims.”

He told Threat Level that as the FBI and law-enforcement divisions of the DoD are called in by victims to investigate known breaches, they often uncover additional victims in the course of gathering forensic evidence and are the first to then notify those entities that they’ve been breached.

Mandia and the other witnesses testified that to better protect networks, there needs to be better sharing of information between the government and private companies to help everyone understand the current threats they’re facing and how to protect against them. To encourage companies to share information about breaches they’ve experienced, the witnesses urged the government to look at providing limited immunity from liability so that companies don’t have to be afraid that customers and others will use the shared information to punish them.

Mandia was also in favor of a safe-harbor program that would separate information-sharing about breaches from the kind of information disclosure that is required under the data breach disclosure laws that exist in most states. Companies would still be required to disclose a breach if it involved personally identifiable information — as the breach laws require — but they would also be able to disclose additional details about the breach to the government in a way that wouldn’t expose their identity.

Currently companies provide only limited details about breaches, because they don’t want to face ridicule or additional liability if the details disclose a failure on the company’s part to adequately secure its network. Mandia says this works against the greater good by holding back information that could help other companies learn from mistakes and protect their own networks.

“The public shaming and the stigma that goes along with it isnt helping,” he told Threat Level. “No ones getting smarter from [information disclosed from] the Sony breach.”

Developing IT risk management decision-making criteria an ongoing challenge

Ask ten information security managers how they define and manage risk, and youll get at leastten distinctly different answers. Many firms have their own unique ways of factoring risk intodecision making, utilizing everything from detailed industry standards to informalspreadsheets.

Many factors such as the industry and distribution in the market determine the amount ofsecurity investment and security testing for a given product.

Gunter Bitz, senior manager of product security governance, SAPAG 

But experts agree that effective informationsecurity risk management processes take time to develop, with even the most matureorganizations constantly searching for the best way to come to grips with rapid changes in thethreat landscape and the effect they have on the security of their products and services.

Performing risk assessments for every product that leaves the production line has been anevolving process at EMC Corp., where each product manager is required to provide metrics on qualityand support requirements, residual risk and other factors that weigh heavily on strategic decisionsat the company. Eric Baize, senior director in the office of strategy and technology at RSA, theBedford, Mass.-based security division of EMC Corp., has a company-wide responsibility for productsecurity assurance. Baize said it has taken years to reach a level of maturity to where risk-baseddecision making is a fundamental process.

Its now very much ingrained into the fabric of our product organizations, Baize said. Theserisk decisions are now easier to make, but it is not easy to get to that point.

A number of methodologies and best practices exist to help guide companies into making morecalculated risk-based decisions. NIST provides a set of best practices that can be used as a guidefor injecting risk into the decision making process. The NIST Risk Management Frameworkoutlines steps organizations can take from categorizing systems to assessing current securitycontrols, to prioritizing and making changes based on impact analysis. The NIST framework beginswith categorizing systems and processes based on the likelihood that they will be impacted. It thenguides organizations into selecting appropriate security controls, implementing them and thenperforming an assessment. Other frameworks take broader approaches, incorporating governance andcompliance processes. The Committee of Sponsoring Organizations (COSO) Enterprise Risk ManagementIntegrated Framework (.pdf), encompasses strategic goals and operational resources to meetreporting and compliance objectives. Meanwhile, the COBIT IT governanceframework focuses on policy development and getting IT to effectively support businessgoals.

But even the best guides fail to factor in each organizations unique requirements, said PeteLindstrom, research director at Malvern, Penn.-based Spire Security. Further complicating theproblem is that far too many organizations are using multiple frameworks. Applying quantitativeanalysis can be tricky to introduce to different parts of an organization, Lindstrom said, becausethere are so many different factors that weigh into risk-based decisions.

The idea is to evaluate the controls youre putting in place based on the likelihood the assetyoure protecting will be impacted significantly by external or internal events, Lindstromsaid.  Many organizations are generally not assessing things from the likelihood of impactperspective, which is a purer form of risk measurement.

Gary McGraw, CTO of Dulles, Va.-based Cigital Inc., whose Building Security in Maturity Model,or BSIMM, assesses the software security processes at more than 40 organizations, includingMicrosoft, Bank of America, Adobe Systems and Google, said documenting how organizations approachrisk-based decision making is difficult, because risk is typically directly tied into businessconcerns.

Some firms start out with a risk-based questionnaire to categorize or classify their productsinto different risk categories and then adjust their SDL according to their results, McGraw said.Others have already categorized their high-risk applications and theyll put almost all theirfocus on them.

One issue with risk assessments is a large number of organizations apply separate, disparaterisk management approaches to specific project areas instead of taking a cohesive approach,Lindstrom said. To address the problem, ISACA, a nonprofit association of IT professionals, issuedthe RISKIT framework in 2009. Based on the COBIT IT governance framework, RISK IT aims to helporganizations manage risks related to late project delivery, compliance and obsolete ITarchitecture. The organization said RISK IT brings together a variety of concepts and approaches,such as COSO ERM, ARMS and ISO31000. The framework is intended to get executives and management to apply an enterprise-widerisk framework rather than applying risk assessments in incomplete, disconnected areas of theorganization.

Gunter Bitz, senior manager of product security governance at SAP, said the German softwarevendor has for many years categorized projects based on risk metrics and other factors. SAP weavesa risk-based approach into each set of requirements for a project, Bitz said. The enterprisesoftware maker also evaluates each product to determine if the industry uses it and the threatsposed to the industry. For example, an application developed for the defense industry wouldlogically be considered a higher risk, he said. Product managers also think through the kind ofactivity an application manages to gain an understanding of the significance of an application.

Many factors such as the industry and distribution in the market determine the amount ofsecurity investment and security testing for a given product," Bitz said. 

How the M00p Malware Gang Was Brought Down

A piece of malware from the M00p group showing their name embedded in the code. Courtesy of F-Secure

It’s rare that malware-writing crews get arrested for creating the tools that criminals use.

But a presentation at the Virus Bulletin conference in Spain this week described an extensive operation in which law enforcement agents worked successfully with the Finnish anti-virus firm F-Secure to catch two members of the M00p gang, makers of malware that allowed criminals to steal passwords and proprietary documents, remotely control web cams and commandeer computers for use as spambots.

Detective Constable Bob Burls of the Police Central e-Crime Unit in the United Kingdom described, along with F-Secure Chief Research Officer Mikko Hypponen, how “Operation Kennet” was ultimately able to identify two members of the M00p gang Matthew Anderson and Artturi Alm which operated from 2004 to 2006. The Finnish company F-Secure got involved in part because M00p crafted malware-infected e-mails that were designed to look like they came from F-Secure.

According to Sophos’ Graham Cluley, who attended the presentation, Burls came onto the case while investigating an intrusion at a hospital that was infected with a piece of M00p botnet malware. He discovered that the botnet communicated with a domain registered to one warpiglet@gmail.com. That address was soon linked to Anderson, a 33-year-old father of five from Scotland, and his company Opton-Security, which purported to be a computer security firm.

In a synchronized early-morning raid in 2006 by British and Finnish police, the two suspects were arrested. Anderson was caught logged in as administrator to the M00p IRC server when he was arrested, and Alm had an open IRC connection to M00p’s IRC channel.

Among the evidence police found on a computer seized from Anderson were incriminating chat logs and sinister images taken secretly of female victims whose webcams had been compromised. In one of the chat logs, the father of five was caught reportedly bragging to another hacker that he’d compromised a teenage girl’s PC and then snapped a picture of her with her webcam after she burst into tears upon discovering that her computer had been commandeered by him.

Alm turned out to be particularly daft at crime. He reportedly embedded his Social Security number in some of the malware the group distributed and also had an arm tattoo bearing the online nick he used to commit his crimes, “Okasvi.”

Despite evidence gathered from the computers and a confession, Alm was sentenced only to community service. Anderson got an 18-month jail sentence. Although the M00p operation was shut down, other members of the gang, reportedly from Canada, Finland, France, Italy, Kuwait, Scotland, and the U.S., remained at large.

Judge Refuses to Sanction CIA for Destroying Waterboarding Videos

A federal judge won’t hold the CIA in contempt for destroying videotapes of detainee interrogations that included the use of a torture technique known as waterboarding, ruling instead Wednesday that the spy agency merely committed “transgressions” for its failure to abide by his court order.

Punishing the Central Intelligence Agency, U.S. District Judge Alvin Hellerstein of New York ruled, “would serve no beneficial purpose.” (.pdf)

Hellerstein wrote that CIA officials responsible for producing the tapes in a Freedom of Information Act lawsuit might “not have been aware of the videotapes’ existence before they were destroyed.” The judge also said officials who ordered the tapes’ destruction in 2005 might not have been “aware of court orders requiring identification or production of the videotapes.”

The American Civil Liberties Union, which brought the long-running FOIA case and asked for a contempt finding, had requested that Judge Hellerstein order depositions and discovery to ascertain if CIA officials destroyed the 92 videotapes of post 9/11 interrogations of terrorism suspects after they had notice of court orders to produce them.

The judge declined.

“I will not allow additional discovery,” the judge said. He added that the CIA has admitted that some of the videos showed the CIA using waterboarding torture techniques. Footage on one tape, he said, had shown an interrogator who “continuously applied large volumes of water to a cloth that covered the detainee’s mouth and nose.” The Obama administration has declined to prosecute CIA officials for torture, citing legal memos that authorized the techniques.

Hellerstein said because of the tapes’ destruction, the CIA “improved protocols for the retention of records potentially relevant to an investigation or a judicial, congressional, or administrative proceeding.”

The judge said the tapes’ destruction “exposed serious flaws” in the CIA’s document-retention procedures, and he noted that the CIA in August “adopted new document preservation and destruction protocols to insure against similar transgressions in the future.”

Alexander Abdo, an ACLU staff attorney, blasted Hellerstein’s ruling.

“While today’s decision recognizes that the CIA violated a court order when it destroyed the torture tapes, we are profoundly disappointed by the courts unwillingness to label as contempt what it describes as the CIA’s ‘dereliction.’ We also strongly disagree with the courts finding that the CIA has ‘remedied’ the destruction,” Abdo said in a statement. “The truth is that the CIA destroyed evidence of torture, and the destruction of this evidence has made it harder to hold high-level officials accountable for the abuse that they authorized.”

The CIA in 2007 admitted to destroying the tapes of interrogations of alleged al-Qaeda members Abu Zubaydah and Abd al-Rahim al-Nashiri. A special prosecutor last year found that CIA officials should not be charged for the tapes’ destruction.

A year before the tapes were destroyed, Hellerstein ordered the CIA “to produce or identify all responsive documents” in response to the ACLU’s request for “records concerning the treatment of individuals apprehended after September 11, 2001, and held by the United States at military bases or detention facilities outside the United States.”

Hellerstein ordered the CIA to pay the ACLU’s legal expenses.

Photo: Mike Licht, NotionsCapital.com/Flickr

See Also:

• Surveillance, Not Waterboarding, Led to bin Laden
• Navy Commandos Expect Their Shrinks to Be Waterboarded
• Motivational Manager Waterboarded Employee to Spur Sales, Suit Alleges
• Obamas Prisoner Dilemma: Reject Torture, Defend Torturers
• Solitary Confinement: The Invisible Torture
• Torture, Same As It Ever Was
• ACLU Demands Eavesdropping, Torture Memos From White House

How the M00p Malware Gang Was Brought Down

A piece of malware from the M00p group showing their name embedded in the code. Courtesy of F-Secure

It’s rare that malware-writing crews get arrested for creating the tools that criminals use.

But a presentation at the Virus Bulletin conference in Spain this week described an extensive operation in which law enforcement agents worked successfully with the Finnish anti-virus firm F-Secure to catch two members of the M00p gang, makers of malware that allowed criminals to steal passwords and proprietary documents, remotely control web cams and commandeer computers for use as spambots.

Detective Constable Bob Burls of the Police Central e-Crime Unit in the United Kingdom described, along with F-Secure Chief Research Officer Mikko Hypponen, how “Operation Kennet” was ultimately able to identify two members of the M00p gang – Matthew Anderson and Artturi Alm – which operated from 2004 to 2006. The Finnish company F-Secure got involved in part because M00p crafted malware-infected e-mails that were designed to look like they came from F-Secure.

According to Sophos’ Graham Cluley, who attended the presentation, Burls came onto the case while investigating an intrusion at a hospital that was infected with a piece of M00p botnet malware. He discovered that the botnet communicated with a domain registered to one warpiglet@gmail.com. That address was soon linked to Anderson, a 33-year-old father of five from Scotland, and his company Opton-Security, which purported to be a computer security firm.

In a synchronized early-morning raid in 2006 by British and Finnish police, the two suspects were arrested. Anderson was caught logged in as administrator to the M00p IRC server when he was arrested, and Alm had an open IRC connection to M00p’s IRC channel.

Among the evidence police found on a computer seized from Anderson were incriminating chat logs and sinister images taken secretly of female victims whose webcams had been compromised. In one of the chat logs, the father of five was caught reportedly bragging to another hacker that he’d compromised a teenage girl’s PC and then snapped a picture of her with her webcam after she burst into tears upon discovering that her computer had been commandeered by him.

Alm turned out to be particularly daft at crime. He reportedly embedded his Social Security number in some of the malware the group distributed and also had an arm tattoo bearing the online nick he used to commit his crimes, “Okasvi.”

Despite evidence gathered from the computers and a confession, Alm was sentenced only to community service. Anderson got an 18-month jail sentence. Although the M00P operation was shut down, other members of the gang, reportedly from Canada, Finland, France, Italy, Kuwait, Scotland, and the U.S., remained at large.

Software Makers Win Big in Supreme Court Copyright Fight

The Supreme Court is refusing to review a federal appellate panel’s decision that software makers may use shrink-wrap and click-wrap licenses to forbid the transfer or resale of their wares.

Without comment, the justices on Monday let stand a 9th U.S. Circuit Court of Appeals ruling that is another erosion of the so-called “first-sale” doctrine, which the Supreme Court began to chip away at last year.

The first-sale doctrine generally is an affirmative defense to copyright infringement. It usually allows legitimate owners of copyrighted works to resell those copies.

That 3-0 circuit court decision means copyright owners may prohibit the resale of their wares by inserting clauses in their sales agreements. Autodesk had done that with a version of its popular AutoCAD software. The San Rafael, California company sued to enforce those terms in its sales agreement and prevailed.

The Motion Picture Association of America and Software & Information Industry Association, whose members include Google, Adobe, McAfee, Oracle and dozens of others, urged the appellate court to rule as it did.

The American Library Association and eBay argued against that outcome. The library association said it feared that the software industrys licensing practices could be adopted by other copyright owners, including book publishers, record labels and movie studios.

That assertion was not lost on the appeals court. It ruled Congress is free to modify copyright law “if it deems these or other policy considerations require a different approach.”

The 9th Circuit’s ruling last year was believed to be among the first appellate decisions directly addressing whether a user agreement could forbid resales of software. The appellate courts have previously backed companies that have imposed terms on how software may be used.

The 9th Circuit had reversed a lower court judge who ruled the first-sale doctrine applied whenever the consumer is entitled to keep the copy of the work, thus allowing consumers to resell their purchased software at will.

The case concerned Autodesks AutoCAD Release 14, which was for sale on eBay. Autodesk, invoking the Digital Millennium Copyright Act, demanded eBay remove the item from the site, and it promptly did in 2007.

Timothy Vernor, the seller, had purchased at least four copies of the software from a company that was required to dispose of the software under an Autodesk user agreement. Vernor re-posted the sale on eBay and his eBay account was terminated after Autodesk complained. Litigation ensued and the Supreme Court rejected his challenge Monday.

Autodesk imposed a significant number of restrictions on its software: The company required that the software could not be transferred or leased without Autodesks written consent, and the software could not be transferred outside the Western Hemisphere.

The first-sale doctrine of 1909, in its current form, says the “owner of a particular copy” of a copyrighted work may sell or dispose of his copy without the copyright owners authorization.

Last year, the Supreme Court ruled Costco could be liable for copyright infringement for selling foreign-made watches without the manufacturer’s authorization.

Omega, of Switzerland, sued Costco for copyright infringement because Costco was obtaining the watches from unauthorized European dealers that sold them far cheaper than U.S.-based Omega distributors.

Omega copyrighted the watch design in the United States by imprinting the company’s emblem on the underside of the timepiece. The justices upheld a lower court decision saying the first-sale doctrine did not apply to goods produced overseas.

Hat Tip: techdirt

Photo: deltaMike/Flickr

See Also:

• Supreme Court Deciding Whether Congress May Copyright Public Domain Works
• Supreme Court Gets RIAA Copyright Case
• Supreme Court Rules Against First-Sale Copyright Doctrine
• Supreme Court Docket: Surveillance, Profanity and Thought Patents
• High-Court Nominee Mirrors Industry Copyright Stance Update
• Supreme Court Term in Review: Its a Mixed Bag
• Supreme Court Declines Music Download Case

DHS cloud computing: Homeland Securitys model private cloud strategy

The Department of Homeland Security (DHS) has launched a cloudcomputing strategy that could serve as a model for other federal agencies -- especially thosewhose managers are still losing sleep over possible security risks associated with the cloud.

I feel very comfortable that our private cloud services are just as secure as our otherapplications that live within our data centers.

Richard Spires, CIO, Department of Homeland Security

DHS is in the process of establishing private cloud services to manage sensitive data as part ofits effort to consolidate more than 40 data centers into two enterprise data centers at separatelocations. One data center, located at NASAs Stennis Space Center in Mississippi, is managed byComputer Sciences Corp. The other, in Clarksville, Va., is owned and operated by HewlettPackard.

We are hosting our private cloud services out of those two centers, said DHS Chief InformationOfficer Richard Spires. They back up each other so we have redundancy where we need it formission-critical applications. If one were to go down, we could shift mission-critical operationsfrom one to the other.

The DHScloud computing initiative is moving nine different services to its private cloud, includinglegacy email systems, collaboration environments that improve information sharing, andauthentication services across the department.

The departments private cloud model, using two commercially managed data centers -- one ofwhich is located at a government-owned facility -- offers the strong sense of security and controlprovided by a private cloud, but also stands to yield the cost savings expected from a publiccloud.

I feel very comfortable that our private cloud services are just as secure as our otherapplications that live within our data centers and are not part of our private cloud services,Spires said. At the same time, all those services [are] priced as if we went through a publiclybased cloud. So we buy the email on per email box basis, just as if we went to an Amazon orMicrosoft or something on the outside.

In a white paper about cloud computing onthe federal CIO Councils website, Spires said early projections put DHS cost savings at 8% to10% once the transition to private cloud services is complete. Not only does the move to ourprivate cloud model eliminate redundancy and reduce costs, it also bolsters information security,he said.

Spires advised managers at other federal agencies who are migrating applications or services toa private cloud -- or who are considering it -- to work with their chief information securityofficers to integrate security standards into their private cloud services.

What weve done [is to] set up a set of standard controls that have been endorsed by our CISO,Bob West, for our private cloud under Federal Information Security Management Act requirements, hesaid. FISMAclassifies federal systems into low-, medium- and high-risk categories, each levelhaving its own requirements.

A second part of the departments cloud computing strategy involves moving its public-facingwebsites to public clouds over the next few years. Through a General Services Administrationprocurement vehicle, DHS recently awarded its first task order to migrate the departmentsnon-sensitive, public-facing websites to a public cloud provider, Spires said.

We hope to take more advantage of public cloud-based services as we get more comfortable withthe security model and feel comfortable that we can start to migrate some of our sensitive data toa public cloud, he said. Right now, we essentially want to cut our teeth on using our outwardfacing websites since theres no sensitive data on those sites.

Verizon PCI report finds firms struggling to maintain compliance

Many businesses struggle to maintain PCI DSS compliance, suggesting that meeting the standard isa goal rather than an ongoing initiative, according to a new report from Verizon Business.

The 2011 Verizon Payment Card IndustryCompliance Report (pdf.) is based on findings from more than 100 PCI DSS assessments conductedby Verizons PCI Qualified Security Assessors in 2010. The report, which also combined statisticsfrom the 2011Verizon Data Breach Investigations Report, examined how well organizations comply with the 12specific PCI requirements.

Compliance among Level 1 and Level 2 organizations remained consistent with Verizons 2010PCI compliance report. Only 21% of organizations were fully compliant during an initialassessment. Organizations eventually achieve compliance, but fail to maintain a state of compliancethrough the next assessment period, said Wade Baker, director of Risk Intelligence for VerizonBusiness.

This is clearly an event for them rather than something that is a continuous process, Bakersaid. Were seeing lots of scrambling to get things in order for the assessor and thats not theintent of PCI DSS at all.

On average, Verizon QSAs are finding merchants are meeting about 80% of what is required to meetPCI DSS. Companies are often overconfident, Baker said, because they achieved compliance in anearlier assessment and they often think they can walk through it easily again, but that is clearlynot the case.

Changes in the merchants environment such as an acquisition, a new point-of-sale (POS) systemor an agreement with a new processor can change the scope of a new assessment. Organizations arealso not always sure of the boundaries of their cardholder environment, Baker said.

The Verizon PCI report found some technology and policy improvements. Companies were doing abetter job encrypting credit card data and sensitive cardholder information across public networks.Organizations were also improving restrictions on sensitive information to employees with aneed-to-know.

But other areas remained a constant struggle. Organizations faced difficulties protecting storedcardholder data, tracking and monitoring access and maintaining security policies three of the 12requirements outlined in the PCI DSS.

In addition, organizations are failing to take a risk-based approach to addressing securitythreats. Instead of applying security policies and technologies to address the systems andapplications with the highest risk of being attacked, organizations are taking a checklist approachto PCI DSS, Baker said.

The report also addressed common techniques used by attackers to gain access to credit carddata. For the second year in a row remote access to systems via backdoors was a favorite attacktechnique of cybercriminals.  Once an attacker penetrates a system, a common procedure is touse malware to upload data to a remote sever. Poor authentication remains an issue. Stolen accountcredentials or the use of default passwords is a common technique to gain access to systemscontaining cardholder data.

Cybercriminals target smaller merchants

While high-profile data breaches tend to focus on breaches with massive amounts of exposedcardholder data, PCI Level 3 and Level 4 merchants with a lower number of credit card transactionsare facing more threats than ever before, according to Baker.  The Verizon DBIR, issuedearlier this year, found cybercriminals ignoring larger companies with hardened systems, insteadtargeting restaurant franchises and other smaller businesses that often lack knowledgeable IT staffor cash to invest and maintain security technologies.

Companies between1 to 100 employees are being targeted right now, more than Verizon investigators have ever seenbefore, according to Baker. Further compounding the problem, it takes small businesses longer todiscover a breach. Smaller firms have limited log information and monitoring capabilities.

There is a sudden increase in smaller organizations being breached, Baker said. Cybercriminaltechniques are refined enough to where theyre choosing a very small target, getting a small numberof card numbers, but then repeating the processes over and over again to make a high enoughprofit.

Supreme Court Declines Music Download Case

The Supreme Court is declining to decide whether downloading a song is a public performance requiring artists to get paid additional royalties.

The American Society of Composers, Authors and Publishers, known as ASCAP, asked the justices to review a lower court decision that said downloading songs from iTunes, Amazon, eMusic or even music-sharing services do not count as public performances, and hence additional royalties are unwarranted. On Monday, the court let stand that decision without comment.

The group, with 400,000 members, maintained in its petition to the justices that the Copyright Act demanded the extra royalties, which could amount to tens of millions of dollars in extra revenue annually. The appeals court said that downloading a music file is more aptly characterized as “reproducing” that file, and not subject to performance rights.

The 2nd U.S. Circuit Court of appeals, ruling against ASCAP, said “perform,” as outlined in Section 101 of the Copyright Act, means to “recite, render, play, dance or act it either directly or by means of any device or process.”

ASCAP licenses the right to perform publicly the musical works of its members to a diverse array of music users, including internet and network-based sites and services, television and radio stations, restaurants, hotels and sports arenas.

The artists, represented by Theodore Olson, a former U.S. solicitor general, told the justices in their petition that the case was of “vital importance.” (.pdf)

“If the Second Circuits decision stands, songwriters and music publishers across the nation will be denied their statutory right to receive royalties for public performanceswhen their works are downloaded over the internet — which is already one of the most prevalent means for the dissemination of copyrighted musical works,” Olson wrote.

The government, backed by Solicitor General Donald Verrilli Jr., a former Recording Industry Association of America attorney, urged the justices to reject ASCAP’s petition.

“Because the download itself involves no dancing, acting, reciting, rendering, or playing of the musical work encoded in the digital transmission, it is not a performance of that work,” the government wrote the justices.

See SCOTUSblog for documents in the case.

Photo: Phil Dokas/Flickr

See Also:

• ASCAP Assails Free-Culture, Digital-Rights Groups
• Judge: Cellphone Ringtones Are Not Concerts
• ASCAP Cracks Down on 26 Venues for Playing Music without a License
• ASCAPs Webcasting/Mobile Revenue Up 70%
• Does Government Owe Royalties on Torture Music?
• Does Music on Second Life Infringe Copyright?

Firms struggle to address social networking security risks, survey finds

Many enterprises continue to lack security controls that address the threats posed by the use ofsocial networks in the workplace, according to a new survey conducted by the Ponemon Institute.

More companies have formal policies offering guidance and setting requirements for how employeesshould be using social networks.

Lenny Zeltser, a SANS instructor and director at NCRCorp.

The new Global Survey on Social Media Risks, conducted by the Ponemon Institute andcommissioned by security vendor Websense Inc., polled 4,000 IT professionals in 12 countries on thesecurity technologies and policies used to protect against malware and other threats posed by theuse of social networks in the workplace. While the threats are generally well understood, manyfirms struggle to address socialnetworking security risks, the survey found.

Only 29% indicated their organization had necessary social networking security controls, and 76%identified antivirus and antimalware as the technology commonly relied on to reduce social mediathreats.

Most respondents agree that the use of social media in their workplace is important to achievebusiness goal; its not just personal, said Larry Ponemon, chairman and founder of the TraverseCity, Michigan-based Ponemon Institute. Theres a real struggle going on because policies aredifficult to enforce and technology is seen as a possible business disrupter.

Employees commonly check Facebook, Twitter and other social networks throughout the business dayand some firms are concerned with the lack of productivity and the securityrisks posed by social networks. In addition, marketing departments rely on social networks tocommunicate with customers. Yet many threats exist. Cybercriminals use social engineering tacticsto lure social network users into clicking on malicious links leading to attack websites. Fifty-twopercent of those surveyed by the Ponemon Institute indicated an increase in malware attacks as adirect result of employee use of social media.

Data leakage is also a serious concern. Employees can inadvertently post information aboutcompany information such as meetings or technologies. Organizations have accepted social networkingas an important communications tool for both personal and business reasons, said Lenny Zeltser, aSANS instructor and director at NCR Corp. The threats are understood fairly well, Zeltser said.

They are accepting that these interactions will occur and are trying to provide some trainingand some guidance on how to do this safely and securely, Zeltser said. More companies have formalpolicies offering guidance and setting requirements for how employees should be using socialnetworks.

Zeltser said policy enforcement is difficult. Technologies exist to control Web interactions,and filter content, gateway antivirus and endpoint antivirus help address malware threats, but dataleakage and brand damage is still a difficult threat to address, he said.

The Ponemon study found policy enforcement issues. About 65% of those surveyed indicated theirorganization does not enforce acceptable use or they said they were unsure. Social media is seen asone of a bevy of security risks to the enterprise, with 43% indicating other security issues weregiven a greater priority.

There is a huge gap between social media enterprise adoption and protection, Ponemon said.But social media has emerged as an integral part of what people do so organizations are beingcareful not to upset their best employees and drive away younger talented individuals tocompetitors.

GPS Inventor Urges Supreme Court to Reject Warrantless Tracking

President George W. Bush presents the National Medal of Technology to GPS inventor Roger L. Easton in 2006. The award is the nation's highest honor for technology achievements. (AP Photo/Pablo Martinez Monsivais)

The principal inventor of the Global Positioning System is asking the U.S. Supreme Court to renounce the Obama administration’s position that it may affix GPS devices to vehicles and track their every move without a court warrant.

Roger L. Easton, awarded the National Medal of Technology in 2006, joined the Center for Democracy & Technology, the Electronic Frontier Foundation and other academics in a friend-of-the-court brief lodged Monday in one of the biggest Fourth Amendment cases in a decade — one weighing the collision of privacy, technology and the Constitution. The justices are scheduled to argue the case Nov. 9.

Easton, now 90 and the principal inventor and developer of the Timation Satellite Navigation System at the Naval Research Laboratory more than five decades ago, and the others are telling the high court that its precedent on the topic is outdated, and the government’s reliance on it should be rejected.

One of the Obama administration’s main arguments in support of warrantless GPS tracking is the high court’s 1983 decision in United States v. Knotts, in which the justices said it was OK for the government to use beepers known as “bird dogs” to track a suspect’s vehicle without a warrant. Unlike beeper-assisted surveillance, which requires human “visual” surveillance, “GPS tracking is an automated process wholly divorced from human observation,” (.pdf) the amicus brief said.

A beeper enhances the effectiveness of real-time visual surveillance by enabling police officers to confirm that the vehicle that they see is the vehicle being tracked and providing a means of re-establishing visual surveillance. If officers become separated from the vehicle by more than a few miles, however, they must criss-cross the area until they pick up the beeper signal again. GPS tracking, by contrast, does not require anyvisual surveillance by police officers after the receiver has been installed. Instead, the receiver automatically calculates its location once every ten seconds. A police computer receiving that information through a cell phone connection then uses a mapping program to plot the receiver’s and therefore the vehicle’s location. The technology enables the police to monitor and record the vehicle’s location without ever observing or following the car themselves.

Beeper-assisted surveillance, the brief continues, “requires a police officer to follow the targeted vehicle, for the duration of the surveillance, in order to ascertain the vehicle’slocation. That is because the beeper and receiver function only as directional finders, indicating the vehicles direction relative to the receiver, and thereby aiding in visual surveillance by pointing the police in the direction of the vehicle. The vehicle’s actual location can be determined only through the police officer’s observations.”

What’s more, “a beeper’s signal could be monitored from a distance of two to four miles on an open road and up to twenty miles in the air. In congested urban areas, the range could drop to about two blocks.” However, GPS pinpoints targets within “centimeters,” the brief said.

Among other arguments, the government told the justices that “Knotts, like this case, involved the use of a tracking device to monitor the movements of a vehicle on public roads. The tracking device in that case — a beeper — enabled officers to maintain surveillance of the vehicle’s movements when visual observations failed.

The friend-of-the-court brief, written by Jeffrey Meyer of the Yale Law School Supreme Court Clinic and and Andrew Pincus and Charles Rothfeld of the law firm Mayer Brown in Washington, D.C., goes into great detail about how beepers and GPS devices work.

The (GPS) receiver calculates its latitude, longitude, and altitude based on transmissions from the four nearest satellites using a process called trilateration. This process is best illustrated by imagining a GPS receiver located on the ground and four satellites (Satellites A, B, C, and D) located in the sky. The GPS receiver calculates that it is 10 miles away from Satellite A. Therefore, the receiver knows it is located somewhere on the surface of a sphere with a 10-mile radius, with the center of the sphere being Satellite A. Next, the receiver calculates it is located 15 miles away from Satellite B, which again means that it is located somewhere on the surface of a sphere with a 15-mile radius, centered on Satellite B. By repeating these calculations with Satellites C and D, the receiver can calculate where all four spheres intersect with each other, which will be one discrete point on the Earth’s surface. A GPS receiver also can compute its speed and the direction it is traveling with the data it receives from the satellites.

Ten years ago, the justices ruled that the authorities must obtain search warrants to employ thermal-imaging devices to detect indoor marijuana-growing operations, saying the imaging devices carry the potential to “shrink the realm of guaranteed privacy.”

In the case now before the justices, the Obama administration is demanding the high court reinstate the conviction and life sentence of a cocaine dealer whose vehicle was tracked via GPS for a month without a court warrant. A federal appeals court had reversed the conviction, saying such monitoring amounted to an illegal search of defendant Antoine Jones in violation of the Fourth Amendment. The conviction was based on court warrants to search and find drugs in the locations where Jones had traveled.

The justices accepted the governments petition to hear the case to clear conflicting lower-court rulings on when warrants are required for GPS tracking. The government told the justices that GPS devices have become a common tool in crime fighting.

Easton declined comment.

See Also:

• Surveillance, Not Waterboarding, Led to bin Laden
• Wired 9.12: The Surveillance Society
• Domestic Surveillance Court Approved All 1,506 Warrant Applications in 2010
• Beyond Surveillance: Darpa Wants a Thinking Camera
• ACLU Study Highlights U.S. Surveillance Society
• How 9/11 Completely Changed Surveillance in U.S.
• Senator Wants Investigation of OnStars Brazen Privacy Invasion

Idaho Lab in a Race to Shore Up Critical Infrastructure Systems

IDAHO FALLS, Idaho – All it took was one click of a mouse from the CEO of the ACME Chemical company.

Within half an hour of that tap hackers had exfiltrated proprietary documents from the company’s network, commandeered IP-based surveillance cameras at the facility to spy on network administrators, seized control of a computer system managing its chemical mixing process and finally caused a toxic spill that administrators were powerless to stop.

The nondescript two-story building where the exercise occurred is unmarked on the outside and is just one of dozens of INL facilities scattered in and around the small agricultural town of Idaho Falls.

The perpetrators of this industrial disaster? ACME’s competitors at the Barney Advanced Domestic chemical company or BAD Chem, for short who also cut power to the plant at one point, sending ACME employees scrambling in blind confusion and panic.

The actual perpetrators of this simulated exercise were employees of the Idaho National Laboratory (INL) who opened their control system training facility to reporters last week to show how the Department of Homeland Security, in conjunction with the Department of Energy lab, is training people who run industrial control systems to do so securely, to fend off real-life instances of the simulated attack played out for journalists.

“[Attackers] are kicking on the doors of these systems, and in some cases there have been intrusions,” said Greg Schaffer, acting deputy undersecretary for DHS’s National Protection and Programs Directorate, without elaborating on the intrusions.

The nondescript two-story building where the exercise occurred is unmarked on the outside and is just one of dozens of INL facilities scattered in and around the small agricultural town of Idaho Falls. The lab holds week-long training sessions about once a month for workers from various industries, including energy, transportation, and oil and gas. Most critical infrastructures in the U.S. are privately owned and operated, and are not governed by any regulations requiring owners to secure them. The White House is urging Congress to pass legislation that would require such facilities to obtain third-party audits certifying that they meet certain cybersecurity criteria, but in the meantimeINL and DHS operate a program to conduct security assessments of control systems and also offer security training to workers.

During the week-long session at the training facility, students are divided into a Red Team (attackers) and Blue Team (defenders), with each receiving a playbook containing a minimal amount of background information on the target company. The target network consists of web servers, e-mail servers and control systems that all contain multiple vulnerabilities commonly found in real-world systems, such as default hard-coded passwords and communication protocols that transmit commands in cleartext the same kinds of flaws that a researcher recently found in control systems made by the German conglomerate Siemens.

Vulnerabilities in control system networks have been in the spotlight since last year when the Stuxnet worm was found on computers in Iran, the U.S. and elsewhere. The sophisticated worm was designed to attack a specific Siemens industrial control system operating a uranium enrichment facility in central Iran. It was the first known targeted attack against an industrial control system and the first malware found in the wild that was designed to cause physical destruction. The malware, launched in June 2009, is believed to have damaged about 1,000 centrifuges at the enrichment plant before it was discovered in June 2010. Fingers have pointed at Israel and the U.S. as the likely culprits behind the malicious code.

DHS and INL operate a malware analysis lab about a mile from the training center in Idaho Falls, where INL experts reverse-engineered the Stuxnet code last year after it was found on systems in the U.S. Marty Edwards, Director of DHS’s Control Systems Security Program, wouldn’t discuss the details of what the researchers found in Stuxnet, although private researchers have already released extensive analysis of the worm. Edwards said DHS did disclose some of its findings in private to companies and facilities that needed to protect themselves from the worm or copycat attacks.

“I still believe that [the technical details are] sensitive,” Edwards told reporters last week. “You’re not going to see us post those kind of details to a completely open, public web site. Because we don’t want to encourage the script kiddie or the copycat types.”

A second program at the INL lab works with the makers of industrial control systems to examine and test the systems for security vulnerabilities. Last year 75 vendors had their control system products examined by the lab, but because the findings are bound by non-disclosure agreements with vendors, the lab won’t disclose its findings. Edwards said vendors are required to provide the lab with a report within a year after an assessment, providing information about steps the vendor has taken to patch or mitigate vulnerabilities the lab found in the vendor’s system. Though he admits that some basic vulnerabilities, or design flaws as he calls them, cannot easily be patched by vendors. Hard-coded passwords are among these.

In 2008, the lab conducted a security vulnerability assessment of the Siemens system that was later targeted by Stuxnet. The New York Times suggested earlier this year that information gleaned from that assessment was subsequently used by the creators of Stuxnet to attack the Siemens system in Iran, indicating that the lab may have played a role in the creation of Stuxnet. But Edwards denied that the lab’s research contributed to Stuxnet.

“There was no research that was done [by the lab] that was leveraged to create Stuxnet,” he said, adding that Stuxnet targeted different vulnerabilities than those that were uncovered during the INL assessment.

Story photo: Cyber security analysts that were part of the Blue Team watch their computers during a mock exercise last week at the Department of Homeland Security’s secretive cyber defense training facility at Idaho National Laboratory. (AP Photo/Mark J. Terrill)

Homepage photo: A reflection of the Department of Homeland Security logo is seen in the glasses of a cyber security analyst in the watch and warning center at the Department of Homeland Security’s secretive cyber defense facility at Idaho National Laboratory, which is intended to protect the nations power, water and chemical plants, electrical grid and other facilities, Friday, Sept. 30, 2011, in Idaho Falls, Idaho. (AP Photo/Mark J. Terrill)

Hayden Urges Congress to Let NSA Monitor Public Networks for Threats

Former NSA and CIA Director Michael Hayden at CIA headquarters in Langley, Va., in 2009. (AP Photo/Luis M. Alvarez)

Former NSA and CIA director Michael Hayden revived a controversial meme on Tuesday when he urged Congress to allow his former agency to monitor public networks in order to defend against malicious activity coming from nation states and others.

“We’ve got capability on the sidelines wanting policy guidance,” he told the House Intelligence Committee, referring to the NSA. “And when we can enrich that guidance and get them in the field, the better — the safer — we are.”

Hayden’s remarks echoed what Director of National Intelligence Admiral Dennis Blair told the same committee in 2009 when he said that the NSA, rather than the Department of Homeland Security, which currently oversees cybersecurity issues on government networks and liaisons with the public sector about securing critical infrastructure networks, was the only agency with the skills needed to secure cyberspace.

“The National Security Agency has the greatest repository of cyber talent,” Blair said. “[T]here are some wizards out there at Fort Meade who can do stuff.”

The NSA’s role in the Bush Administrations secret and warrantless domestic spying program, however, has raised concerns among civil libertarians that the agency couldn’t be trusted to monitor networks without violating the privacy of citizens.

Hayden acknowledged to lawmakers that there was “a natural political cultural allergy to letting NSA” monitor private networks, but he said there were ways the spy agency could do so without reading the content of communications or otherwise intruding on the civil liberties of private citizens.

“We want NSA to protect us, but we don’t want NSA out there being present where our own communications are flowing,” he said. “And we’re just going to have to have a serious chat [about that]. I think we can do that — both the technology and the ethic at NSA would allow us to do that. But it will require some convincing before the agency is given that authority.”

Hayden also said there were still some people who didn’t have a proper appreciation of the threat the U.S. was facing from foreign attackers. Speaking about recent spates of attacks on U.S. companies and government agencies that appeared to come from China, Hayden said that “as a professional intelligence officer, I step back in awe at the breadth, depth, sophistication and persistence of the Chinese espionage effort against the United States of America.”

Also appearing before the committee on Tuesday was Art Coviello, executive chairman of RSA Security, which was targeted in a serious attack earlier this year that forced the company to re-issue security tokens to customers after intruders compromised a system used to generate secret codes for RSA SecurID tokens.

Coviello told lawmakers the attack on RSA’s network “could not have been perpetrated by anyone other than a nation state.” He also supported Hayden’s assertion that the NSA should be more involved in protecting U.S. systems.

“We ought to be able to figure out a way for the NSA, which has so much expertise, to work their way in an ethical way to protect us,” he said. “To me its a tragedy that we cant get them more heavily involved working with Homeland Security to a point where they can be more effective protecting American organizations.”

Kevin Mandia, CEO of Mandiant, also spoke at the hearing. Mandia, whose company has investigated numerous headline-making breaches since its founding in 2004, said that in more than 90 percent of the intrusion cases his company has investigated, the victims didnt know they had been breached until a government agency told them them so.

In our last 50 incidents, 48 of the victim companies learned they were breached from the Federal Bureau of Investigation, the Department of Defense or some other third party, Mandia said.

With virtually every other crime, the victim is the first to know that they have been violated,” Mandia said in a prepared statement. “Here, however, we have the government in the unique position of informing victims that they are, in fact, victims.”

He told Threat Level that as the FBI and law-enforcement divisions of the DoD are called in by victims to investigate known breaches, they often uncover additional victims in the course of gathering forensic evidence and are the first to then notify those entities that they’ve been breached.

Mandia and the other witnesses testified that to better protect networks, there needs to be better sharing of information between the government and private companies to help everyone understand the current threats they’re facing and how to protect against them. To encourage companies to share information about breaches they’ve experienced, the witnesses urged the government to look at providing limited immunity from liability so that companies don’t have to be afraid that customers and others will use the shared information to punish them.

Mandia was also in favor of a safe-harbor program that would separate information-sharing about breaches from the kind of information disclosure that is required under the data breach disclosure laws that exist in most states. Companies would still be required to disclose a breach if it involved personally identifiable information — as the breach laws require — but they would also be able disclose additional details about the breach to the government in a way that wouldn’t expose their identity.

Currently companies provide only limited details about breaches, because they don’t want to face ridicule or additional liability if the details disclose a failure on the company’s part to adequately secure its network. Mandia says this works against the greater good by holding back information that could help other companies learn from mistakes and protect their own networks.

“The public shaming and the stigma that goes along with it isnt helping,” he told Threat Level. “No ones getting smarter from [information disclosed from] the Sony breach.”

U.S. Signs International Anti-Piracy Accord

The United States, Australia, Canada, Japan, Morocco, New Zealand, Singapore and South Korea signed the Anti-Counterfeiting Trade Agreement on Saturday, an accord targeting intellectual property piracy.

The European Union, Mexico and Switzerland — the only other governments participating in the accord’s creation — did not sign the deal at a ceremony in Japan but “confirmed their continuing strong support for and preparations to sign the agreement as soon as practical,” the parties said in a joint statement.

The United States applauded the deal.

“As with many of the challenges we face in todays global economy, no government can single-handedly eliminate the problem of global counterfeiting and piracy. Signing this agreement is therefore an act of shared leadership and determination in the international fight against intellectual property theft,” said Mariam Sapiro, deputy United States trade representative.

Thedeal, more than three years in the making and open for signing until May 2013, exports on participating nations an intellectual-property enforcement regime resembling the one in the United States.

Rashmi Rangnath, a staff attorney with Public Knowledge in Washington, D.C., said the deal “clearly, is an attempt to foist U.S. law on other countries.”

Among other things, the accord demands governments make it unlawful to market devices that circumvent copyright, such as devices that copy encrypted DVDs without authorization. That is akin to a feature in the the Digital Millennium Copyright Act in the United States, where the law has been used by Hollywood studios to block RealNetworks from marketing DVD-copying technology.

The accord, which the United States says does not require Congressional approval, also calls on participating nations to maintain extensive seizure and forfeiture laws when it comes to counterfeited goods that are trademarked or copyrighted. Most important, countries must carry out a legal system where victims of intellectual property theft may be awarded an undefined amount of monetary damages.

In the United States, for example, the Copyright Act allows for damages of up to $150,000 per infringement. A Boston jury has dinged a college student $675,000 for pilfering 30 tracks on Kazaa, while a Minnesota jury has awarded the Recording Industry Association of America $1.5 million for the purloining of 24 songs online.

A U.S.-backed footnote removed from the document more than a year ago provided for “the termination” of internet accounts for repeat online infringers. U.S. internet service providers and content providers, however, have brokered such a dealtoward that goal.

Until European Union authorities began leaking the document’s text, the Obama administration was claiming the accord was a “national security” secret.

Photo: MikeBlogs/Flickr

See Also:

• ACTA Draft: No Internet for Copyright Scofflaws
• ACTA Backs Away From 3 Strikes
• Europe Worries U.S. Bowing to Industry in ACTA Talks
• Heres That Leaked Copyright Treaty Document
• Copyright Treaty Is Policy Laundering at Its Finest

Developing IT risk management decision-making criteria an ongoing challenge

Ask ten information security managers how they define and manage risk, and youll get at leastten distinctly different answers. Many firms have their own unique ways of factoring risk intodecision making, utilizing everything from detailed industry standards to informalspreadsheets.

Many factors such as the industry and distribution in the market determine the amount ofsecurity investment and security testing for a given product.

Gunter Bitz, senior manager of product security governance, SAPAG 

But experts agree that effective informationsecurity risk management processes take time to develop, with even the most matureorganizations constantly searching for the best way to come to grips with rapid changes in thethreat landscape and the effect they have on the security of their products and services.

Performing risk assessments for every product that leaves the production line has been anevolving process at EMC Corp., where each product manager is required to provide metrics on qualityand support requirements, residual risk and other factors that weigh heavily on strategic decisionsat the company. Eric Baize, senior director in the office of strategy and technology at RSA, theBedford, Mass.-based security division of EMC Corp., has a company-wide responsibility for productsecurity assurance. Baize said it has taken years to reach a level of maturity to where risk-baseddecision making is a fundamental process.

Its now very much ingrained into the fabric of our product organizations, Baize said. Theserisk decisions are now easier to make, but it is not easy to get to that point.

A number of methodologies and best practices exist to help guide companies into making morecalculated risk-based decisions. NIST provides a set of best practices that can be used as a guidefor injecting risk into the decision making process. The NIST Risk Management Frameworkoutlines steps organizations can take from categorizing systems to assessing current securitycontrols, to prioritizing and making changes based on impact analysis. The NIST framework beginswith categorizing systems and processes based on the likelihood that they will be impacted. It thenguides organizations into selecting appropriate security controls, implementing them and thenperforming an assessment. Other frameworks take broader approaches, incorporating governance andcompliance processes. The Committee of Sponsoring Organizations (COSO) Enterprise Risk ManagementIntegrated Framework (.pdf), encompasses strategic goals and operational resources to meetreporting and compliance objectives. Meanwhile, the COBIT IT governanceframework focuses on policy development and getting IT to effectively support businessgoals.

But even the best guides fail to factor in each organizations unique requirements, said PeteLindstrom, research director at Malvern, Penn.-based Spire Security. Further complicating theproblem is that far too many organizations are using multiple frameworks. Applying quantitativeanalysis can be tricky to introduce to different parts of an organization, Lindstrom said, becausethere are so many different factors that weigh into risk-based decisions.

The idea is to evaluate the controls youre putting in place based on the likelihood the assetyoure protecting will be impacted significantly by external or internal events, Lindstromsaid.  Many organizations are generally not assessing things from the likelihood of impactperspective, which is a purer form of risk measurement.

Gary McGraw, CTO of Dulles, Va.-based Cigital Inc., whose Building Security in Maturity Model,or BSIMM, assesses the software security processes at more than 40 organizations, includingMicrosoft, Bank of America, Adobe Systems and Google, said documenting how organizations approachrisk-based decision making is difficult, because risk is typically directly tied into businessconcerns.

Some firms start out with a risk-based questionnaire to categorize or classify their productsinto different risk categories and then adjust their SDL according to their results, McGraw said.Others have already categorized their high-risk applications and theyll put almost all theirfocus on them.

One issue with risk assessments is a large number of organizations apply separate, disparaterisk management approaches to specific project areas instead of taking a cohesive approach,Lindstrom said. To address the problem, ISACA, a nonprofit association of IT professionals, issuedthe RISKIT framework in 2009. Based on the COBIT IT governance framework, RISK IT aims to helporganizations manage risks related to late project delivery, compliance and obsolete ITarchitecture. The organization said RISK IT brings together a variety of concepts and approaches,such as COSO ERM, ARMS and ISO31000. The framework is intended to get executives and management to apply an enterprise-widerisk framework rather than applying risk assessments in incomplete, disconnected areas of theorganization.

Gunter Bitz, senior manager of product security governance at SAP, said the German softwarevendor has for many years categorized projects based on risk metrics and other factors. SAP weavesa risk-based approach into each set of requirements for a project, Bitz said. The enterprisesoftware maker also evaluates each product to determine if the industry uses it and the threatsposed to the industry. For example, an application developed for the defense industry wouldlogically be considered a higher risk, he said. Product managers also think through the kind ofactivity an application manages to gain an understanding of the significance of an application.

Many factors such as the industry and distribution in the market determine the amount ofsecurity investment and security testing for a given product," Bitz said. 

Hayden Urges Congress to Allow NSA to Monitor Public Networks for Malicious Activity

Former NSA and CIA Director Michael Hayden at CIA headquarters in Langley, Va., in 2009. (AP Photo/Luis M. Alvarez)

Former NSA and CIA director Michael Hayden revived a controversial meme on Tuesday when he urged Congress to allow his former agency to monitor public networks in order to defend against malicious activity coming from nation-states and others.

“We’ve got capability on the sidelines wanting policy guidance,” he told the House Intelligence Committee, referring to the NSA. “And when we can enrich that guidance and get them in the field, the better – the safer – we are.”

Hayden’s remarks echoed what Director of National Intelligence Admiral Dennis Blair told the same committee in 2009 when he said that the NSA, rather than the Department of Homeland Security, which currently oversees cybersecurity issues on government networks and liaisons with the public sector about securing critical infrastructure networks, was the only agency with the skills needed to secure cyberspace.

“The National Security Agency has the greatest repository of cyber talent,” Blair said. “[T]here are some wizards out there at Fort Meade who can do stuff.”

The NSA’s role in the Bush Administrations secret and warrantless domestic spying program, however, has raised concerns among civil libertarians that the agency couldn’t be trusted to monitor networks without violating the privacy of citizens.

Hayden acknowledged to lawmakers that there was “a natural political cultural allergy to letting NSA” monitor private networks, but he said there were ways the spy agency could do so without reading the content of communications or otherwise intruding on the civil liberties of private citizens.

“We want NSA to protect us, but we don’t want NSA out there being present where our own communications are flowing,” he said. “And we’re just going to have to have a serious chat [about that]. I think we can do that – both the technology and the ethic at NSA would allow us to do that. But it will require some convincing before the agency is given that authority.”

Hayden also said there were still some people who didn’t have a proper appreciation of the threat the U.S. was facing from foreign attackers. Speaking about recent spates of attacks on U.S. companies and government agencies that appeared to come from China, Hayden said that “as a professional intelligence officer, I step back in awe at the breadth, depth, sophistication and persistence of the Chinese espionage effort against the United States of America.”

Also appearing before the committee on Tuesday was Art Coviello, executive chairman of RSA Security, which was targeted in a serious attack earlier this year that forced the company to re-issue security tokens to customers after intruders compromised a system used to generate secret codes for RSA SecurID tokens.

Coviello told lawmakers the attack on RSA’s network “could not have been perpetrated by anyone other than a nation state.” He also supported Hayden’s assertion that the NSA should be more involved in protecting U.S. systems.

“We ought to be able to figure out a way for the NSA, which has so much expertise, to work their way in an ethical way to protect us,” he said. “To me its a tragedy that we cant get them more heavily involved working with Homeland Security to a point where they can be more effective protecting American organizations.”

Kevin Mandia, CEO of Mandiant, also spoke at the hearing. Mandia, whose company has investigated numerous headline-making breaches since its founding in 2004, said that in more than 90 percent of the intrusion cases his company has investigated, the victims didnt know they had been breached until a government agency told them them so.

In our last 50 incidents, 48 of the victim companies learned they were breached from the Federal Bureau of Investigation, the Department of Defense or some other third party, Mandia said.

With virtually every other crime, the victim is the first to know that they have been violated,” Mandia said in a prepared statement. “Here, however, we have the government in the unique position of informing victims that they are, in fact, victims.”

He told Threat Level that as the FBI and law-enforcement divisions of the DoD are called in by victims to investigate known breaches, they often uncover additional victims in the course of gathering forensic evidence and are the first to then notify those entities that they’ve been breached.

Mandia and the other witnesses testified that to better protect networks, there needs to be better sharing of information between the government and private companies to help everyone understand the current threats they’re facing and how to protect against them. To encourage companies to share information about breaches they’ve experienced, the witnesses urged the government to look at providing limited immunity from liability so that companies don’t have to be afraid that customers and others will use the shared information to punish them.

Mandia was also in favor of a safe harbor program that would separate information-sharing about breaches from the kind of information disclosure that is required under the data breach disclosure laws that exist in most states. Companies would still be required to disclose a breach if it involved personally identifiable information – as the breach laws require – but they would also be able disclose additional details about the breach to the government in a way that wouldn’t expose their identity.

Currently companies provide only limited details about breaches, because they don’t want to face ridicule or additional liability if the details disclose a failure on the company’s part to adequately secure its network. Mandia says this works against the greater good by holding back information that could help other companies learn from mistakes and protect their own networks.

“The public shaming and the stigma that goes along with it isnt helping,” he told Threat Level. “No ones getting smarter from [information disclosed from] the Sony breach.”

Verizon PCI report finds firms struggling to maintain compliance

Many businesses struggle to maintain PCI DSS compliance, suggesting that meeting the standard isa goal rather than an ongoing initiative, according to a new report from Verizon Business.

The 2011 Verizon Payment Card IndustryCompliance Report (pdf.) is based on findings from more than 100 PCI DSS assessments conductedby Verizons PCI Qualified Security Assessors in 2010. The report, which also combined statisticsfrom the 2011Verizon Data Breach Investigations Report, examined how well organizations comply with the 12specific PCI requirements.

Compliance among Level 1 and Level 2 organizations remained consistent with Verizons 2010PCI compliance report. Only 21% of organizations were fully compliant during an initialassessment. Organizations eventually achieve compliance, but fail to maintain a state of compliancethrough the next assessment period, said Wade Baker, director of Risk Intelligence for VerizonBusiness.

This is clearly an event for them rather than something that is a continuous process, Bakersaid. Were seeing lots of scrambling to get things in order for the assessor and thats not theintent of PCI DSS at all.

On average, Verizon QSAs are finding merchants are meeting about 80% of what is required to meetPCI DSS. Companies are often overconfident, Baker said, because they achieved compliance in anearlier assessment and they often think they can walk through it easily again, but that is clearlynot the case.

Changes in the merchants environment such as an acquisition, a new point-of-sale (POS) systemor an agreement with a new processor can change the scope of a new assessment. Organizations arealso not always sure of the boundaries of their cardholder environment, Baker said.

The Verizon PCI report found some technology and policy improvements. Companies were doing abetter job encrypting credit card data and sensitive cardholder information across public networks.Organizations were also improving restrictions on sensitive information to employees with aneed-to-know.

But other areas remained a constant struggle. Organizations faced difficulties protecting storedcardholder data, tracking and monitoring access and maintaining security policies three of the 12requirements outlined in the PCI DSS.

In addition, organizations are failing to take a risk-based approach to addressing securitythreats. Instead of applying security policies and technologies to address the systems andapplications with the highest risk of being attacked, organizations are taking a checklist approachto PCI DSS, Baker said.

The report also addressed common techniques used by attackers to gain access to credit carddata. For the second year in a row remote access to systems via backdoors was a favorite attacktechnique of cybercriminals.  Once an attacker penetrates a system, a common procedure is touse malware to upload data to a remote sever. Poor authentication remains an issue. Stolen accountcredentials or the use of default passwords is a common technique to gain access to systemscontaining cardholder data.

Cybercriminals target smaller merchants

While high-profile data breaches tend to focus on breaches with massive amounts of exposedcardholder data, PCI Level 3 and Level 4 merchants with a lower number of credit card transactionsare facing more threats than ever before, according to Baker.  The Verizon DBIR, issuedearlier this year, found cybercriminals ignoring larger companies with hardened systems, insteadtargeting restaurant franchises and other smaller businesses that often lack knowledgeable IT staffor cash to invest and maintain security technologies.

Companies between1 to 100 employees are being targeted right now, more than Verizon investigators have ever seenbefore, according to Baker. Further compounding the problem, it takes small businesses longer todiscover a breach. Smaller firms have limited log information and monitoring capabilities.

There is a sudden increase in smaller organizations being breached, Baker said. Cybercriminaltechniques are refined enough to where theyre choosing a very small target, getting a small numberof card numbers, but then repeating the processes over and over again to make a high enoughprofit.