Blog

Europe is poised to tackle cybersecurity headfirst with initiatives that are growing in strength and support. In 2013, the Cybersecurity Strategy for the European Union and the Commission Proposal for a Directive on Network and Information Security presented legal measures and provided incentives aimed at increasing the security of Europe’s online environment. These efforts are supported by theEuropean Network and Information Security Agency (ENISA), as well as by the Computer Emergency Response Team for the EU institutions (CERT-EU).

As part of ISACA’s holistic Cybersecurity Nexus (CSX), ISACA is addressing the need for cybersecurity guidance in Europe by releasing the European Cybersecurity Implementation Series of white papers and an audit program, which includes:

• European Cybersecurity Implementation: Overview
• European Cybersecurity Implementation: Risk
• European Cybersecurity Implementation: Resilience
• European Cybersecurity Implementation: Assurance
• European Cybersecurity Audit/Assurance Program

The white papers address cybersecurity in the context of European Union (EU) laws, regulations and best practice, with a focus on using the COBIT 5 framework and related materials. They provide practical implementation guidance that is aligned with ENISA, European requirements and good practices.

The overview outlines how cybersecurity is discussed and directed in the European context, including institutions, organisations and recognized best practices. In some aspects, this is different from what might be expected in a U.S. setting or other geographies, given that there are 28 EU member states and several associated countries. As a result, there are EU level cybersecurity recommendations as well as national strategies, laws and regulations to be taken into account. This overview paper is designed to provide orientation and set the scene for more detailed aspects discussed in the risk, resilience and assurance papers.

Cybersecurity creates a multitude of new risks, many of which are part of the cultural, social and technical context of security. The risk paper in the series therefore addresses typical European perspectives on cybersecurity risk, including those that may be unique to one or more countries within the Union. In line with the COBIT 5 lens concept, the risk paper further provides a drill-down on using the available COBIT 5 cybersecurity materials in a targeted manner.

Resilience is one of the primary, but often neglected, aspects of cybersecurity. In Europe, resilience thinking is an important element of cybersecurity, both in the business and in the technical sense. The resilience paper within the cybersecurity series addresses the European view on creating, maintaining and improving resilience through various steps of a life cycle. It also covers European and national laws, regulations and best practices in creating cybersecurity resilience.

With the advent of a directional and declared EU cybersecurity strategy and digital agenda, many cybersecurity initiatives are beginning to produce results, often set down as legal, regulatory or industry requirements. In terms of cybersecurity governance and management, it is important to provide robust assurance over cybersecurity arrangements, including auditable evidence and processes. The assurance paper within the cybersecurity series offers insights on how to set up, maintain and uphold the requisite level of assurance in the EU and associated countries. The paper makes use of tried and tested COBIT 5 concepts and the underlying control universe and applies these to the EU landscape.

The ISACA European Cybersecurity Implementation Series is a living set of documents. In the near future, additional helpful tools will be released. These include a matching and mapping tabular paper for quick reference purposes throughout the 28 member states, as well as so-called country files providing subject matter expert advice on cybersecurity details in many European countries.

Rolf von Roessing, CISA, CISM, CGEIT
President, Forfa AG
Past International Vice President, ISACA

He will discuss “Responding to Cyberattacks” and “COBIT 5 for Security” at ISACA’s 2014 EuroCACS/ISRM Conference taking place 28 September – 1 October in Barcelona, Spain. For more information about the conference and to register, visitwww.isaca.org/eucacs-isrm2014.

[Source: ISACA]

Hacktivists from Anonymous and from a presumed Islamic extremist group targeted a variety of online gaming services.

Services are up and running again after a denial of service took down Sony’s PlayStation Network for much of Sunday, coinciding with a bomb threat on American Airlines flight 362, which carried John Smedley, president of Sony Online Entertainment. The threats caused the airline to divert the flight.

Other online gaming services — including Microsoft’s XBox Live, Eve Online, and the services that host World of Warcraft and Diablo III — also experienced disruptions. The culprits seem to be hacktivists, but just which hacktivists is unclear, because several are trying to take credit for the attack, citing different motives.

One group, Lizard Squad, took credit for the attacks and presented two motives on Twitter. One tweet Sunday morning said that Sony “aren’t spending the waves of cash they obtain on their customers’ PSN service. End the greed.” A subsequent tweet stated, “Kuffar [non-believers] don’t get to play videogames until bombing of the ISIL [Islamic State of Iraq and the Levant] stops.” The account made many references to the Islamic extremist group ISIS.

On Sunday afternoon, Lizard Squad also tweeted the cryptic message “.@AmericanAir We have been receiving reports that @j_smedley’s plane #362 from DFW to SAN has explosives on-board, please look into this.”

The group tweeted at Smedley with the hashtag #PrayForFlight362 and a video from 2001 of a plane crashing into the World Trade Center.

On a separate account, a hacker associated with Anonymous claimed responsibility for the attack, showing screen shots to prove the work and stating that the attack was launched to highlight vulnerabilities in the PlayStation Network.

Microsoft confirmed that some customers were experiencing disruptions. However, it seems that Lizard Squad found that Microsoft’s XBox Live network was sturdier than Sony’s. The group tweeted Monday, “Microsoft props to you for giving us a challenge, good work. Sony, smh [shaking my head].”

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad of other topics. She authored the 2009 CSI Computer Crime and Security Survey and founded the CSI Working Group on Web Security Research Law — a collaborative project that investigated the dichotomy between laws regulating software vulnerability disclosure and those regulating Web vulnerability disclosure.

[Source: DarkReading]

The year 2014 has been dubbed “The Year of the Cyberattacks” before it even reached the halfway point, with aftershocks fromHeartbleed still being felt weeks later. But did you know that attacks and bugs like Heartbleed are often 100 percent preventable? Simply put, best IT practices can create red flags before damage can be done. But, when humans are involved, laziness and shortcuts can lead to missed security steps. Technology, of course, is programmed and designed by humans, so the possibility forhuman error in technology is everywhere.

And it is not just human fault here, but also the technology. This is a two-pronged fork. According to security expert Richard Kenner, programs should never read from the same place in memory where they were written. That is security safety 101, but that is exactly what happened with Heartbleed. It has already been estimated that millions of dollars are being paid out by enterprises affected by Heartbleed, but what lessons can be learned from this?

Technology: Not as cutting edge as you think
Kenner points out that the programming language involved in Heartbleed is more than 40 years old; and even though new languages have been developed (and are arguably safer), that doesn’t mean they have been adopted. In addition to keeping up with languages and improving upon them, best practices simply were not followed in order to stop Heartbleed. There is technology available that ensures programs meet key properties (like that pesky reading from memory writing issue), but most companies fail to utilize it.

“The program that contained the Heartbleed bug did exactly that and an attempt to prove that it didn’t would have quickly found the bug, as would the use of certain tools that also detect this type of error,” says Kenner.

There are also other best practices, such as ensuring that security services do not transmit private information like passwords, usernames or identifiers. That sounds like a given, but it is (unfortunately) common practice.

Moving forward
Lessons to be learned from Heartbleed include: Creating safer passwords, changing them regularly and only using one password per web site. Additionally, web sites need to make better use of one-time passwords, which can be annoying but can prevent information from being hacked.

I advise using client certificates, even if they are a bother to acquire, because they are proof that you really are who you say you are. Many of these precautions can take a little extra time, and time is notoriously what many professionals do not have.

Perhaps the biggest flaw that led to the Heartbleed outbreak is that only a small handful of executives, far from experts in technology and security, were put in charge. They had full plates, they did not understand what was at stake, and they too easily put this task on the back burner.

When a small group of people assumes someone else is taking care of things that open up a world of vulnerability. It all comes back to proper management at every level and better communication between IT and the rest of the staff to make sure everyone is on the same page.

Larry Alton
Business consultant

[Source: ISACA]