“In business, what’s dangerous is not to evolve.”

-Jeff Bezos

eBay hacked, all users asked to change passwords http://www.scmagazine.com/ebay-hacked-all-users-asked-to-change-passwords/article/347967/

http://www.securityweek.com/after-cyberattack-ebay-recommends-password-change

http://www.infosecurity-magazine.com/view/38528/researchers-blast-ebay-over-data-breach/

http://www.darkreading.com/attacks-breaches/ebay-database-hacked-with-stolen-employee-credentials-/d/d-id/1269093?

http://www.csoonline.com/article/2158083/data-protection/how-to-protect-your-company-from-an-ebay-like-breach.html

C-IT Recommendation

  1. Ensure your organization has Firewalls/Intrusion Prevention Solutions in place that is capable of block incoming attempts of malicious activity
  2. Verify your security appliances are reporting to a Security Information and Event Management tool (SIEM) that correlates events and displays intelligible information to security analysts.
  3. Validate your organization has an efficient Security Operations Center (SOC) of which trained analysts are trained to alert on potential malicious events or malicious sources.
  4. Ensure your entity has a log management standard, policy and procedure that addresses
    1. Log retention- ensuring that all computer logs can be accessed in the case of an investigation
    2. Log reviews- enabling the possible early detection of events based upon irregular log entries
  5. Consider using two-factor authentication for your customer base to minimize the probability of accounts being compromised
  6. Verify your company has an effective and enforced data classification standard which requires data owners to seriously assess data sensitivity and requires data custodians to properly secure the information to need-to-know only basis.
  7. Perform periodic access reviews for data stores and applications housing highly classified or confidential information to ensure appropriate access is enforced. Any users or groups who are discovered to have access and don’t have a need to have access should be immediately removed.
  8. Confirm network segmentation in your environment so that only required devices are able to access networks where highly classified or confidential data resides.

Article Resources

SANS Article “What is the Role of a SIEM in Detecting Events of Interest?”

http://www.sans.org/security-resources/idfaq/siem.php

NIST Guide to Computer Security Log Management

http://csrc.nist.gov/publications/nistpubs/800-92/SP800-92.pdf

Ebay blog announcement

https://blog.ebay.com/ebay-inc-ask-ebay-users-change-passwords/

Ebay Frequently Asked Questions Concerning the Breach

http://www.ebayinc.com/in_the_news/story/faq-ebay-password-change

DHS: Control system of U.S. utility company hacked http://www.scmagazine.com/dhs-control-system-of-us-utility-company-hacked/article/347990/

http://www.securityweek.com/ics-cert-report-highlights-industrial-control-system-security-failures

C-IT Recommendation

  1. If your organization business includes power plants, oil or gas refineries, telecommunications facilities, transportation, or water and waste control, it will most likely be using SCADA equipment. If not consult with your HVAC, telecom and facilities department and perform an asset inventory of your SCADA equipment. CMDB should include product manufacturers.
  2. Ensure your company has policies and procedures to maintain the asset inventory to include all scada systems and each piece of industrial equipment controlled by the scada technology
  3. Disable the Web Service. Disabling the HTTPS service and still maintaining manageability on the device can be accomplished in a number of ways. Manage the device through a command line service like SSH, or use a Device Cloud account to centrally manage all the devices. Further, if HTTPS service is enabled and on a public IP on the Internet, restrict or disable the HTTPS web interface to specific IPs.
  4. Check Services. If any HTTPS services have been implemented within Python, please evaluate the code and make sure that it is not impacted. If shell scripting uses the OpenSSL commands, please ensure to mitigate the Heartbeat TLS extension.
  5. Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.
  6. Locate control system networks and remote devices behind firewalls, and isolate them from the business network.
  7. When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.
  8. Remove, disable or rename any default system accounts wherever possible.
  9. Implement account lockout policies to reduce the risk from brute forcing attempts.
  10. Establish and implement policies requiring the use of strong passwords.
  11. Monitor the creation of administrator level accounts by third-party vendors.
  12. Apply patches in the ICS environment, when possible, to mitigate known vulnerabilities.

Article Resources

C-IT Podcast on Industrial Control System News

http://www.c-itsecurity.com/?p=91

Industrial Control Systems Computer Emergency Response Team January -April Newsletter

http://ics-cert.us-cert.gov/sites/default/files/Monitors/ICS-CERT_Monitor_%20Jan-April2014.pdf

Industrial Control Systems Computer Emergency Response Team Defense in Depth Principles

http://ics-cert.us-cert.gov/sites/default/files/recommended_practices/Defense_in_Depth_Oct09.pdf

IBM Chokes Off APTs with Trusteer Apex Launch http://www.infosecurity-magazine.com/view/38521/ibm-chokes-off-apts-with-trusteer-apex-launch/

C-IT Recommendation

  1. Ensure your organization has a solid anti-malware solution at the end point and that all endpoints are covered.
  2. Enforce a patch management standard in your organization which requires security patches to be deployed in the production environment within a reasonable time after they are tested within your test environment.
  3. Test business functionality of each type of device and record any issues impacting any business functions on the devices.
  4. If no issues result in the testing, deploy the security updates to the production systems. If functionality impacting issues occur on the test devices, engage Adobe support and/or vendor support if specific applications are negatively impacted.
  5. Consult with your Vulnerability and Threat Management Team (VTM) to verify all production systems are patched with the latest updates.
  6. Perform an asset inventory of all computers running Windows XP Operating system.
  7. Develop a deployment plan to upgrade all Windows XP OS systems to a Microsoft supported OS or purchase additional support for your Windows XP machines from Microsoft to receive Microsoft XP patch releases.
  8. Implement an advanced malware solution such as Invincea Freespace, FireEye Web Security (NX Series), Source Fire FireAmp to keep remote connections from initiating from your internal network.

Article Resources

Ponemon Institute 2014 Cost of Data Breach Study News release

http://www-03.ibm.com/press/us/en/pressrelease/43825.wss

Study finds payment card info most compromised, breach detection lags http://www.scmagazine.com/study-finds-payment-card-info-most-compromised-breach-detection-lags/article/347997/

Microsoft Silverlight bugs added to Angler Exploit Kit, trojans delivered via malvertising http://www.scmagazine.com/microsoft-silverlight-bugs-added-to-angler-exploit-kit-trojans-delivered-via-malvertising/article/348001/

C-IT Recommendation

  1. Ensure your organization has a solid anti-malware solution at the end point and that all endpoints are covered.
  2. Enforce a patch management standard in your organization which requires security patches to be deployed in the production environment within a reasonable time after they are tested within your test environment.
  3. Test business functionality of each type of device and record any issues impacting any business functions on the devices.
  4. If no issues result in the testing, deploy the security updates to the production systems. If functionality impacting issues occur on the test devices, engage Adobe support and/or vendor support if specific applications are negatively impacted.
  5. Consult with your Vulnerability and Threat Management Team (VTM) to verify all production systems are patched with the latest updates.
  6. Ensure your company is using a web content filtering solution to prevent user from accessing malicious websites.
  7. Validate the web content filtering solution is up to date with the latest stable version with the latest site signature updates
  8. Implement an advanced malware solution such as Invincea Freespace, FireEye Web Security (NX Series), Source Fire FireAmp to keep remote connections from initiating from your internal network.

Article Resources

Cisco Security blog on the Angler Exploit

http://blogs.cisco.com/security/angling-for-silverlight-exploits/

CVE-2013-0074

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0074

See All 50 Episodes of "C-IT Security Podcast "