| |
Georgia Governor Signs Sweeping Gun Bill Into Law
MSNBC (04/23/14) Richinick, Michelle
A gun bill signed into law Wednesday by Georgia Gov. Nathan Deal will allow members of the public to carry weapons into a variety of public locations, including some government buildings that are not staffed by security officers or equipped with security devices. Guns will also be allowed in school classrooms, bars, and nightclubs. Those who have gun permits will be allowed to carry guns into Transportation Security Administration (TSA) checkpoints in airports. Deal said that the legislation "protects the rights to keep and bear arms," while the law's author, state Rep. Rick Jasperse, said the new statute will allow Georgians to protect themselves.
Nurse Stabbings Spur Calls for Workplace Violence Prevention
NBC News (04/21/14) Vargas, Vikki; Avila, Willian
State lawmakers in California could take action on the issue of hospital security following the stabbing of two nurses at two different Southern California hospitals last week. In fact, a state Senate labor committee is scheduled to hear testimony from healthcare workers about workplace violence prevention. The testimony comes as the state Senate is considering a bill that would require hospitals to report workplace violence incidents to the California Occupational Safety and Health Administration (Cal/OSHA), post workplace violence statistics online, implement violence-prevention programs, and hold annual training sessions on the subject. While the bill has the support of the California Nurses Association, the California Hospital Association has denounced it as "vague" and "costly" and says it is "not grounded in hospital safety/security principles.”
Video Analytics Protect Arizona Wastewater Facilities
Security Director News (04/21/14) Canfield, Amy
The Pima County (Ariz.) Regional Wastewater Reclamation Department's use of video analytics for access control and perimeter protection shows how the technology can be used to improve security. According to Pima County officials, the installation of PureActiv geospatial video surveillance software is about 75 percent complete. The software will be used for both access control and perimeter security at three county facilities in the Sonoron Desert. Jackson Jenkins, the director of Pima County RWRD, says the installation of the technology represents a change from the time when cameras were used mostly for equipment monitoring. Installed equipment now also includes Axis and FLIR thermal cameras as well as video management software from OnSSI. This system allows the cameras to be monitored 24/7 and gives users the opportunity to move a camera when an alarm is triggered to get a better view of what the problem may be. "That gives them a lot of flexibility. The cameras are a big enhancement," Jenkins said.
High Stakes on the High Seas
Security Management (04/14) Purvis, Carlton
Retired Navy Admiral Terry McKnight notes that when crime drops on land or sea, people want to cut down the size of the police force. McKnight helped create Combined Task Force 151, an international coalition of navies charged with patrolling the Gulf of Aden and the Indian Ocean in an effort to discourage piracy. The task force established an Internationally Recognized Transit Corridor (IRTC) patrolled by navies that prevent and respond to pirate attacks in 2008, which has helped lead to the reduction of pirate attacks. The European Union, Iran, and the United States all have an interest in trade in the area, and, because of this interest, have navy vessels operating in the region as protection. However, to a large extent the countries whose navies are patrolling these waters are not those whose ships are at risk, and with tight budgets and the numbers of piracy incidents falling, it is possible that the countries patrolling the IRTC could pullback some or all of their forces. Analysts say that if this occurs, merchant vessels are likely to begin sailing along faster routes, instead of the safer ones like the IRTC, and incidents are likely to increase again as pirates make an effort to reestablish control.
Using Architectural Elements for Stronger Security
Security Magazine (04/14) Gilbert, Patrick
Building security begins with smart architectural design, writes architect Patrick Gilbert. Architectural decisions that enhance security should include choices about sight lines as well as ways to protect rooms or buildings from attacks. Good visibility and vantage points for security personnel are important, in addition to the the elimination of blind corners and the minimization of curves and alcoves. The desire to create an open space, Gilbert continues, must be balanced with access concerns. Designs should direct visitors to a single, central area that prevents them from dispersing until they can be screened by security. These are matters that any facility designer should consider, Gilbert maintains, but higher security facilities must take these choices to the next level. Gilbert advises that such buildings be located in inconspicuous and, if possible, remote locations; that the design should not attract attention and should minimize windows; and that the facility should be laid out with the most crucial operations located at the center of the building.
Airport Security Scrutinized After Stowaway Incident
USA Today (04/23/14) Jansen, Bart
The issue of airport perimeter security has gained more attention following the recent incident in which a 15-year-old hid in the wheel well of a plane that was preparing to fly from San Jose International (Calif.) Airport to Hawaii. San Jose International, as well as other airports across the country, are reviewing the security measures they have in place following the incident. Airports commonly secure their perimeters by using video surveillance, motion sensors, patrols by police and civilian guards, and train airport workers to confront any individual who is in a secure area without a proper security badge. However, Illy Gruber of the security firm NICE Systems noted that the chances that a security officer with see something suspicious on one specific camera out of the hundreds of cameras installed at an airport are "close to zero." Security consultant Rafi Ron agrees, saying that airports often cannot afford to monitor all of the security technologies. He added that most airports have failed to secure their perimeters and areas where aircraft are located to the same extent as indoor areas.
Airport Security Vulnerabilities Not Uncommon
Associated Press (04/23/14)
Rafi Ron, the former head of security at Israel's Ben Gurion Airport, says security breaches like the one that took place at San Jose (Calif.) International Airport on Sunday--in which a boy managed to breach the airport's perimeter and stow away inside the wheel well of an airplane--could happen at the nation's other airports as well. Ron notes that this is because perimeter security at San Jose International is similar to the security in place at the overwhelming majority of U.S. airports. Most major airports in the U.S., including San Jose International, use dozens of surveillance cameras to monitor tarmacs and other secure areas. However, the use of security cameras could not prevent the boy in San Jose from making his way to the airport's tarmac and climbing into the plane's wheel well, where he stayed for the duration of a flight to Hawaii. Ron notes that one reason why security cameras by themselves are inadequate is because it is impossible for airport security personnel to monitor all the video feeds from their cameras. Airports can use more sophisticated intrusion detection systems that can alert security when cameras identify possible suspicious activity, though such systems can sometimes produce false alarms and may not be able to identify every security breach.
Al Qaeda's Chief Bomb Maker Killed in U.S.-Backed Attack in Yemen
Homeland Security News Wire (04/23/14)
Officials report that al-Qaida's lead bomb-maker, Ibrahim al-Asiri, was killed by Yemeni forces during a recent U.S.-backed attack on an al-Qaida base in southern Yemen. The attackers included Yemeni special forces on the ground, who were transported by U.S. special forces pilots. They were also supported by drone strikes, and the ambush on al-Asiri was set up with the help of U.S. intelligence. Ground troops attacked a car believed to be carrying al-Asiri, and killed everyone in the car after a brief firefight. A body taken from the car is currently being DNA tested to confirm that it is in fact al-Asiri. Al-asiri would be the most senior member of al-Qaida to have been killed since Osama bin Laden if his death is confirmed.
Dozens Denied Navy Base Access Due to Past Crimes
Associated Press (04/21/14) Vergakis, Brock
Since more stringent rules were put in place following a fatal shooting aboard a Navy destroyer docked in Norfolk, Va., in March, dozens of transportation workers have been denied access to Navy bases on the East Coast because of their criminal histories. The new rules, which were issued by the commander in charge of Navy installations for the majority of the East Coast, prohibit anyone who has been charged with a felony in the last decade from using a Transportation Worker Identification Credential (TWIC) card to gain access to a base. The gunman in the Norfolk shooting had a TWIC card that he used to enter the base, despite the fact that he had a criminal history. However, at the time those crimes were not among those that would have prevented someone from obtaining a TWIC card and using it to access a Naval base. But now anyone who has had a felony conviction in the past 10 years or a misdemeanor conviction within the last five years will no longer be allowed to use a TWIC card to enter a U.S. Navy installation. During the first three weeks after the new rules where implemented, 48 people were denied access to Navy installations in Connecticut, New Jersey, Rhode Island and Virginia out of the 1,018 people who used a TWIC card to try to gain access to the 12 installations in those states.
Spy Agencies Told to Plug Media Leaks
Wall Street Journal (04/21/14) Gorman, Siobhan
Director of National Intelligence James Clapper released a new policy last week that aims to give intelligence agencies greater control of how and when intelligence information is released to the media. The policy, which was formulated following a review Clapper initiated in 2012 in response to an outcry over a series of leaks, prohibits intelligence officials from providing the media with "intelligence information" without first getting clearance to do so from their agency. That provision applies regardless of whether the intelligence information is classified or not. In addition, the policy states that the leaders, deputies, and public affairs officials at intelligence agencies are the only individuals who are authorized to have contact with the media on matters involving intelligence information without needing to receive specific authorization first. Any officer who violates the policy could have their security clearance revoked or even be fired. One senior intelligence official said the policy was implemented in order to prevent Congress from forcing more stringent regulations on the nation's intelligence agencies.
F.B.I. Informant Is Tied to Cyberattacks Abroad
New York Times (04/24/14) Mazzetti, Mark
The FBI reportedly used an informant who was a former member of the hacktivist groups Anonymous and Antisec to coordinate hundreds of cyberattacks against foreign Web sites in 2012, possibly as part of an attempt to collect intelligence. The informant, Hector X. Monsegur, was not involved in the attacks himself but instead directed a number of fellow hackers to carry them out against targets that he provided. One of those hackers was Jeremy Hammond, who is serving a prison sentence for his involvement in the 2011 cyberattack against Stratfor Global Intelligence. Monsegur reportedly gave Hammond a list of more than 2,000 Internet domains that he wanted him to target, including government Web sites in Iran, Pakistan, and Iraq, by exploiting a vulnerability in the Web hosting software Plesk. Hammond says that he was largely unsuccessful in using that vulnerability to carry out attacks, and instead tried other means to create backdoors in the targeted sites in order to steal e-mails and information contained in databases. The stolen information was then uploaded to a server controlled by Monsegur and monitored by the FBI. Other hackers, meanwhile, were instructed to attack the Web sites of Syrian banks and government agencies as well as Brazilian government sites. There is no indication that the FBI directly ordered the attacks. The exact role the bureau played in the cyberattack campaign remains unclear.
Cyberattack Drill Exposes Healthcare Industry's Vulnerabilities
Health Leaders Media (04/23/2014) Mace, Scott
Department of Health and Human Services (HHS) Chief Information Security Officer Kevin Charest says healthcare organizations need to better share cyber threat information. Charest presented this assessment in the wake of the healthcare industry's April 1 cybersecurity drill, CyberRX. "We actually started it off with some fraud, where a physician attempted to have some malicious code written that would allow erroneous images to be created and then they could defraud Medicaid and Medicare," Charest said of the exercise. The drill subsequently evaluated how organizations responded to that incident. Roy Mellinger, the vice president of IT security and chief information security officer for Wellpoint, agrees that the results of the exercise showed many healthcare organizations have the technology to mitigate cyber risks, but they do not have the mechanisms to "coordinate intelligence information and expertise." Jim Koenig of Booz Allen Hamilton, who acted as an observer for the CyberRX drill, also commented on the exercise by saying that rapid technological and regulatory change in the healthcare field makes it necessary that organizations put in place early warning systems for potential cyber threats. "Obviously cyberattacks can reach systems that are connected, and increasingly now, there are more and more medical healthcare delivery, radiology, laboratory, and other healthcare delivery and devices that are connected," he adds.
Report: Iranian-Sponsored Cyber Attacks Increasing
Homeland Security Today (04/22/14) Coleman, Timothy W.
The cybersecurity firm Mandiant's annual report on cybersecurity trends has concluded that the cybersecurity threat landscape has been expanding rapidly worldwide, in terms of both potential targets and the overall playing field. The report noted that there has been an increase in activity from Iran, and that "recent speculation has focused on Iran's interest in perpetrating offensive network attacks against critical infrastructure targets." According to the report, suspected Iran-based attacks against Mandiant clients have grown more focused and become more industry specific. Though such attacks primarily target the energy sector, Mandiant reported that they have also been targeting the networks of several U.S. government agencies. However, researchers noted that suspected Iranian hackers do not seem to "possess the range of tools or capabilities that are hallmarks of a capable, full-scope cyber actor." Iranian attackers have instead placed heavy reliance on publicly-available tools, though Mandiant does not discount the possibility that these hackers could become more sophisticated as time goes on.
Web Apps and Point-of-Sale Were Leading Hacker Targets in 2013, Says Verizon
IDG News Service (04/22/14) Constantin, Lucian
Government agencies were among the top targets for hackers looking to steal data last year, according to Verizon's 2014 Data Breach Investigations Report. The report notes there were 175 confirmed cases of data being exposed at public-sector organizations in 2013, which was behind the finance industry with 465 breaches but ahead of the retail industry with 148 breaches. The most popular attack method used in breaches in all industries was the use of stolen credentials, which contributed to 422 breaches. The report also found that 35 percent of breaches in which data was known to have been exposed involved Web-application attacks, making such attacks the biggest cause of security breaches. Most of these types of attacks were carried out by hacktivists or by financially motivated hackers, the report found. Verizon also notes organizations in all industries have made some headway in reducing the amount of time it takes for them to discover cybersecurity breaches, although it can still take weeks, months, or even a year to discover a breach in some cases. However, the report notes organizations increasingly are discovering breaches themselves instead of relying on third parties.
Government Employees Cause Nearly 60 Percent of Public Sector Cyber Incidents
NextGov.com (04/22/14) Sternstein, Aliya
Fifty-eight percent of cyber incidents reported by the public sector were caused by insider incidents, according to Verizon's latest annual data breach report. Only 1 percent of reported public-sector incidents were the result of attackers exploiting security vulnerabilities in websites. This contrasts with private-sector industries such as mining and manufacturing in which cyberespionage accounted for 40 and 30 percent of incidents, respectively. Verizon analyst Jay Jacobs says this disparity between the public and private sector is more reflective of a difference in reporting standards than the actual frequency of specific types of incidents. He says many public-sector organizations are required by law to report even minor data leaks that private-sector companies usually do not bother recording. For example, 34 percent of insider incidents at public-sector organizations over the past three years were the result of errors such as documents being emailed to the wrong person. By contrast, such errors accounted for only 1 percent of data breach incidents reported in the information technology sector. Jacobs says when the raw numbers of incidents are compared, public- and private-sector organizations actually report similar numbers of serious incidents such as website breaches or espionage.
Abstracts Copyright © 2014 Information, Inc. Bethesda, MD |
No comments:
Post a Comment