There's a "People Element" to security we seem to be forgetting...

Social Engineering, the USB Way 

source: darkreading.com

Those thumb drives can turn external threats into internal ones.

The folks at DarkReading recently got hired by a credit union to assess the security of its network. The client asked that they really push hard on the social engineering button. In the past, they'd had problems with employees sharing passwords and giving up information easily. Leveraging their effort in the report was a way to drive the message home to the employees.

The client also indicated that USB drives were a concern, since they were an easy way for employees to steal information, as well as bring in potential vulnerabilities such as viruses and Trojans. Several other clients have raised the same concern, yet few have done much to protect themselves from a rogue drive plugging into their network. So the DarkReading guys wanted to see if they could tempt someone into plugging one into their employer's network.

In the past they had used a variety of social engineering tactics to compromise a network. Typically they would hang out with the smokers, sweet-talk a receptionist, or commandeer a meeting room and jack into the network. This time, they knew they'd have to do something different. Employees were talking within the credit union and were telling each other that somebody was going to test the security of the network, including the people element.

So DarkReading tried something different by baiting the same employees that were on high alert. They gathered all the worthless vendor giveaway thumb drives collected over the years and imprinted them with their own special piece of software. One of their guys wrote a Trojan that, when run, would collect passwords, log-ins and machine-specific information from the user's computer, and then email the findings back.

The next hurdle was getting the USB drives in the hands of the credit union's  internal users. Simply enough, they made their way to the credit union at about 6am to make sure no employees saw them. They then proceeded to scatter the drives in the parking lot, smoking areas and other areas employees frequented.

Once the drives were seeded, it was time to grab some coffee and watch the employees show up for work. Surveillance of the facility was worth the time involved. It was really amusing to watch the reaction of the employees who found a USB drive. You know they plugged them into their computers the minute they got to their desk.

Upon calling the guy who wrote the Trojan and asking if anything was received at his end, it was revealed that slowly but surely info was being mailed back to him. It would have been lovely to be on the inside of the building watching as people started plugging the USB drives in, scouring through the planted image files, the unknowingly running the piece of software cleverly hidden away by DarkReading.

After about three days, they figured they'd collected enough data. Upon review of their findings, they were amazed at the results. Of the 20 USB drives planted, 15 were found by employees and all had been plugged into company computers. The data  obtained helped to compromise additional systems, and the best part of the whole scheme was the convenience. Everything that needed to happen did, and in a way it was completely transparent to the users, the network and credit union management.

This little "giveaway" takes security loopholes a step further, working off humans' innate curiosity. Email virus writers exploit this same vulnerability, as do phishers and their clever faux websites. The credit union client wasn't unique or special. All the technology and filtering and scanning in the world won't address human nature. But it remains the single biggest open door to any company's secrets.

Disagree? Sprinkle your receptionist's candy dish with USB drives and see for yourself how long it takes for human nature to manifest itself.

The Clash of the Titans; Physical Security and IT Security

IT departments are no strangers to turf wars, but is the one shaping up between those overseeing computer networks and those in charge of physical security about to get really ugly?

Unlike past tussles between say, voice and data communications teams, the contest between IT security and those involved in everything from fire alarms to video surveillance to door-lock access controls tends to involve people who might never have had any reason to cross each other's paths.

Converging physical and logical security: A good idea or not?

"It typically takes a C-level executive to force these organizations to work together," says Tom Flynn, director of marketing in North America for smart-card maker Gemalto. "The fact is there are different entities in a corporation for physical and logical security… We see turf wars happening."

Merging physical and logical security is seen by advocates as a cost-saving step and a natural evolution for facilities maintenance and guard operations, where door-access equipment and video cameras are increasingly IP-enabled, and a smart card-based badge could be used by employees to access both buildings and computers. But resistance to convergence runs deep among traditional physical security managers, who are wary of IT departments taking control. And even IT security experts voice concerns that it's risky, with some strongly opposed to the idea of physical security operations, such as video surveillance streams, riding on the same IP corporate network as the rest of the business.

"Physical security has been about closed systems, but with the move to IP-based systems and connecting campuses there's the need to have the IT and security department involved," says Steve Russo, director of security and privacy technology at IBM's global technology services group. He says there can be advantages in integrating physical security with logical and transactional systems to give management a better picture of what's occurring, especially in retailing. And although network capacity is a concern, it's possible to share an IP network for logical and physical security, he suggests.

"Is there a risk associated with combining it? Absolutely," Russo acknowledges. But he adds: "The logical-security people are looking at threats to the environment. And where we see the interesting spark is that they can take information about physical events and turn it into operational use."

But there's often a cultural rift existing between the physical security department for facilities management, with their isolated closed networks, and the IT department with its systems administrators and security specialists trying to keep scores of Internet-accessing computers and applications running safely.

"With IP-based access control, the 'turf wars' tend to be marginalized once the IT folks realize that a system like ISONAS' PowerNet reader is actually a network appliance," says Steve Rice, Vice President of Sales and Marketing for Colorado based ISONAS Security Systems. "It demands little in the way of network capacity, resources to install and can be supported like any other IP device. The benefits of integrated video, access control and/or other building control systems include a combination of additional detailed information available from a set of closely integrated functionalities (ex. have a picture of personnel involved in an entry event plus network confirmation of the credential information timed exactly to the video feed) as well as the simplicity of dividing what functionality to integrate on a customer by customer basis. This is due to the relative ease of integration with a true network software-based system. So the physical security requirements are met with a minimum of IT resource."

These differences in viewpoint are often heard in the physical-logical security convergence debates. But one of the most ardent advocates for convergence might be Ray O'Hara, executive vice president of international operations, consulting and investigations at Andrews International, which is in the traditional physical security business of "guns, gates and guards," as he puts it.

"The traditional security person and the cyber-security side are both hands-on and doing things for the betterment of the organization," says O'Hara, who recently became president of the board of directors of ASIS International, an organization for security professionals.

But today the physical-security technologies are evolving to the point where "the traditional people need help from the IT people," O'Hara says. There is often discord and mistrust between the physical and logical security divisions. But that needs to be overcome by possibly combining reporting structures so they can more easily collaborate or by setting up a "risk council" to have regular discussions with business managers, he suggests.

IBM's Russo says protocol issues point to the need for standardized compression techniques and transport in physical-security equipment, as well as standard XML-based definitions so that important meta-data can be shared. "Physical security is transitional right now," Russo says, pointing to both the Physical Security Interoperability Alliance and OASIS as organizations trying to further interoperability standards that would add convergence and make it worthwhile.

But to date, Flynn says he is only aware of a handful of large enterprises in the oil-and-gas industry, such as Chevron and Exxon, and pharmaceutical giants such as Pfizer, that have adopted converged smart cards for physical and logical security.

Tough Snail Shell Could Inspire Better Body Armor

source. LiveScience

By Rachael Rettner, LiveScience Staff Writer

A snail's shell that protects it from attacks underwater could provide clues for designing improved body armor to guard human soldiers, a new study suggests.

The research involved an unusual sea snail, the so-called "scaly-foot" snail which was first reported in 2003 and makes its home in the harsh environment of a deep-sea hydrothermal vent in the Indian Ocean. Past studies of the  snail, a type of sea mollusk, revealed its foot was covered in plates of iron-sulfide minerals, and it is now the only known animal today to employ iron sulfides as a structural material.

  

Like other snails, this one also sports a shell covering its body. Although hard, a typical snail's shell will fracture if persistently squeezed by a predatory crab. Hoping to learn exactly how the scaly-foot snail's shell is designed to resist such crushing, the authors took a close look at the shell's structure, examining it on the nanoscale.

 

They saw that shell is composed of three layers: a hard outer layer that contains iron sulfides, similar to the ones identified in its foot scales; a more supple middle layer made of organic material; and a stiff inner layer with a large amount of calcium minerals. This arrangement of "rigid-compliant-rigid" layers creates a trilayer, sandwich structure unique to this snail, the researchers say.

Snail protection

After figuring out the shell's structure, the team used a computer model to simulate how the shell faired when subjected to a penetrating force, similar in strength to the pinching of a crab's claws.

"Each layer does something differently," said lead researcher Christine Ortiz, a materials science and engineering professor at the MIT.

The hard outer layer contains small, grain-like particles. When under attack, these granules help to dispel the energy of the blow, spreading it out across the outer region. Any fractures that occur will disperse along jagged lines guided by the granules, forming fissures in the top layer.

"Cracks that form travel extensively throughout the outer layers, thereby protecting the inner layers and mitigating catastrophic fracture," Ortiz said.

The softer middle layer helps protect the brittle inner layer from cracking, Ortiz explained. And the inner layer itself protects the snail's body from injury. Since this inner layer is rigid, it doesn't displace into the animal's body during an assault, which could cause blunt trauma, Ortiz said.

Put together, the three layers work to help prevent penetration of the shell and also withstand bending.

The outer and middle layers also help the snail to survive in the extreme environment characteristic of hydrothermal vents, since these layers are resistant to dissolving in the highly acidic waters.  And the middle layer protects the snail from temperature changes at the vents.

Snail-like armor and sporting gear

The shell's structure may one day inspire new and better designs for human protective equipment, from body armor to sporting gear. The three-layer arrangement and curved surface give the shell stability and penetration resistance, highly valued characteristics of materials used for armor, Ortiz said.

Automobiles painted with an iron-based, granular coating similar to the one found in the shell's outer layer could dissipate energy in the same way the shell does when undergoing a predator attack.

However, any bio-inspired design would likely not use the exact same materials found in the snail's shell, which has flaws of its own. Scientists would simply use it as a guide, and improve upon the shells shortcomings.

"Nature only uses what's available to it," said Ortiz. Engineers might use a similar design, but replace some of the components with high performance structural, or ballistic materials, she said.

The results were published online Jan. 18 in the journal Proceedings of the National Academy of Sciences.

Financial Security Solutions with Simons-Voss

Whether it is the system, an organization, or people, your world revolves around integrity and verified trust.

It used to be that a brass key was a powerful symbol of trust and protection, bu tin today's world most brass keys are easily duplicated and the locks that depend on them are easily fooled or bypassed. On top of that, managing these keys is expesnsive and the functionality of the keys is very low. Depending on mechanical keys to protect your responsibilities in today's world is like telling your customers that their mattress is a good place to keep their money.

Fortunately SimonsVoss has locks that are as sophisticated as today's financial instruments.

With a wide range of products for various applications you never need to modify the door or frame and yet you end up with a sophisticated electronic lock that can control access by time and day while tracking all usage. Even better, the credentials use an encrypted challenge-response wireless signal that cannot be duplicated or successfully recorded and replayed.

Important Concerns

• High cost of frequent re-keying.
• Keys are easily copied or duplicated.
• No record of which key was used or when it was used.
• No control of when keys may be used.
• Aesthetics are important to provide a warm inviting atmosphere to customers
• Leased facilities, temporary needs for security.
• ATM kiosks and small remote offices.

SimonsVoss Benefits

• Re-keying accomplished with the click of a mouse.
• Transponders are very hard to duplicate and very secure.
• SimonsVoss loicks provide an audit trail so you can see who used the lock and when that access was granted.
• All SimonsVoss locks and credentials can be limited to specific times and/or days at your discretion.
• SimonsVoss locks look like standard locks. No need to advertise your security precautions with big, ugly industrial-looking locks.
• Remove the mechanical lock, apply the SimonsVoss solution. When the need is over replace the mechanical lock and use the SimonsVoss lock for the next need.
• Standalone or networked, the SimonsVoss wireless solutions makes it easy to implement solutions for these applications.

The best news of all is that these locks can be deployed one at a time as standalone solutions or combined under a centrally controlled network so you are not limited by applications that are too small or large to benefit from this solution.

Digital Mortise Cylinder

• The Digital Mortise Cylinder puts electronic access control into the mortise cylinder. Now you can remove the mechanical mortise cylinder and replace it with a digital cylinder.

Digital RIM Cylinder Exit Bar Outside Trim

• The Digital RIM Cylinder puts electronic access control into the RIM cylinder. Now you can apply a digital lock cylinder in many applications where a RIM cylinder is required.

Digital Mortise Cylinder Aluminum Frame Door Lock

• This gives you control over who has access, when they have access, and can track that use for later reference. You can even remove access for a user without their credential being present.

Smart Relay Mag Locks/Cabinets

• Barriers, gates, rolling gates, automatic systems, revolving doors, elevators and alarm systems don't need to exist as separate entities.

SV1C Cylindrical Lock Office Doors

 

• The SimonsVoss SV1C Digital Cylindrical Lock can be applied anywhere a standard commercial cylindrical lock is used without additional holes or wires. 

 

7 Famous Security Breaches

source: NJ.com

When Rutgers doctoral student Haisong Jiang slipped under a security rope to give his girlfriend a kiss before she left on a flight out of Newark Liberty airport Jan. 3, the resulting security breach threw the airport into a lockdown, and inspired everyone from politicians to ordinary business travelers to talk about airport security. While this incident grabbed headlines worldwide, it's only the latest in a long line of high-profile breaches to hit airports, computer networks and even the White House. Take a look at our list of seven famous breaches.

7. Presidential Dinner Crashers: Washington D.C., November 24, 2009
Tareq and Michaela Salahi, a Virginia couple, slipped past security and were uninvited guests at a White House state dinner. The event was to honor Indian Prime Minister Manmohan Singh, but the well-dressed Salahis got all the headlines, mingling with guests and even getting a photograph with President Barack Obama.


Result: White House security systems are under review, two wannabes got 15 minutes of fame and may face criminal charges.

6. Man of Many Talents: Worldwide, Arrested, 1969
New York native Frank Abagnale was at different times an airline pilot, an attorney, a doctor. Actually, he was fooling security officials at airports, hospitals and other institutions. Abagnale was also famous for forging millions of dollars in checks and playing havoc with security systems long before computers.

Result: Abagnale was arrested in 1969 in France, served jailtime and later became a security expert. His life story became the inspiration for "Catch Me if You Can," a movie starring Leonardo DiCaprio and Tom Hanks.

5. Grammy Gatecrasher: New York, Feb. 25, 1998
Picture it: Rock and roll legend Bob Dylan is jamming on stage during the Grammy Awards. Suddenly, a pasty man with no shirt is on stage next to Dylan. How did this guy get past show security? How come he's got SOY BOMB written on his chest? The man gyrates for about a minute on TV before being escorted off by security. The best part? Dylan never missed a beat.

Result: Artist Michael "Soy Bomb" Portnoy  had been hired as one of dozens of show extras to dance in the background as Dylan performed, but he clearly went over the line. He never faced charges, but never got paid for his appearance.

4. This is Only a Drill: Slovakia, Jan. 2, 2010
Airport security workers in Bratislava, Slovakia put a bomb in an unsuspecting passenger's luggage as part of a drill. Problem was, none of the airport staff being drilled removed the explosive and it was loaded onto a plane bound for Dublin. Fortunately, the bomb didn't explode, no one was hurt and the plane landed without incident. The bomb was recovered after the plane landed, when the passenger was arrested for carrying a bomb aboard a plane.


Result: The passenger was released, but European Union officials are demanding changes in Slovakia's airport security procedures.

3. Security breach in the CIA:  Arlington, Va., arrests made Feb. 24, 1994
Some spies spill secrets for ideological reasons. Central Intelligence Agency USSR expert Aldrich Ames was in it for the money. Beginning in 1985, the FBI says Ames shuttled the Soviets classified documents and was paid nearly $2 million over several years. Because he was schooled by the CIA, Ames was able to cloak his misdeeds for years.


Result: Ames and his wife Rosario were arrested, plead guilty and sentenced to jail.

2. Retail Hacker: Miami, Arrested August 17, 2009
If you shopped at T.J. Maxx, ate at Dave & Buster's or bought books at Barnes & Noble, computer hacker Albert Gonzalez may have had access to your credit card number. The feds say Gonzalez led a group of hackers who breached computer security systems and stole 170 million payment card numbers from ordinary people just like you. Gonzalez may have been emboldened by his experiences as a one-time government informant.


Result: Gonzalez's sentencing has been delayed. He's lobbying for a lenient sentence because he has Asperger syndrome.

1. Deadly Painkillers: Chicago, 1982
A string of deaths in and around Chicago in 1982 were blamed on Extra-Strength Tylenol spiked with cyanide. At first it was feared the poison had been introduced during the production of the painkillers, but authorities later said the pills were most likely tainted after they were stocked on supermarket shelves.


Result: The incident led to changes in the way medications are packaged, but the killer or killers remain at large.

© 2010 NJ.com. All rights reserved.

Mind-reading systems could change air security

source: msnbc

Technological developments can blur the line between security and civil liberties.

A would-be terrorist tries to board a plane, bent on mass murder. As he walks through a security checkpoint, fidgeting and glancing around, a network of high-tech machines analyzes his body  language and reads his mind.

Screeners pull him aside.

Tragedy is averted.

As far-fetched as that sounds, systems that aim to get inside an evildoer's head are among the proposals floated by security experts thinking beyound the X-ray machines and metal detectors used on millions of passengers and bags each year.

On Thursday, in the wake of the Christmas Day bombing attempt over Detroit, President Barack Obama called on Homeland Security and the Energy Department to develop better screening technology, warning: "In the never-ending race to protect our country, we have to stay one step ahead of a nimble adversary."

The ideas that have been offered by security experts for staying one step ahead include highly sophisticated sensors, more intensive interrogations of tevelers by screeners trained in human behavior, and a lifting of the U.S. prohibitions against profiling.

Some of the more unusual idea are already being tested. Some aren't being given any serious  consideration. Many raise troubling questions about civil liberties. All are costly.

"Regulators need to accept that the current approach is outdates," said Philip Baum, editor of the London-based magazine Aviation Security International. "It may have responded to the threats of the 1960s, but it doesn't respond to the threats of the 21st century."

Here's a look at some of the ideas that could shape the future of airline security:

Mind readers

The aim of one company that blends high technology and behavioral psychology is hinted at in its name WeCU - as in "We See you."

The system that Israeli-based WeCY Technologies has devised and it testing in Israel projects images onto airport screens, such as symbols associated with certain terrorist group of some other image only a would-be terrorist would recognize, said company CEO Ehud Givon.

The logic is that people can't help reacting, even if only subtly, to familiar images that suddenly appear in unfamiliar places. If you strolled through an airpost and saw a picture of your mother, Givon explained, you couldn't help but repsond.

The reaction could be a darting of the eyes, an increased heartbeat, a nervous twitch or faster breathing, he said.

The WeCU system would use humans to do some of the observing but would rely mostly on hidden cameras or sensors that can detect a slight rise in body temperature and heart rate. Far more sensitive devices under development that can take such measurements from a distance would be incorporated later.

If the sensors picked up a suspicious reactions, the traveler could be pulled out of line for further screening.

"One by one, you can screen out from the flow of people those with specific malicious intent," Givon said.

Some critics have expressed horror at the approach, calling it Orwellian and akin to "brain fingerprinting."

For civil libertarians, attempting to read a person's thoughts comes uncomfortably close the the future world depicted in the movie "Minority Report," where a policeman played by Tom Cruise targets people for "pre-crimes," or merely thinking about breaking the law.

Lie Detectors

One system being studied by Homeland Security is called the Future Attribute Screening Technology, or FAST, and works like a souped-up polygraph.

It would subject people pulled aside for additional screening to a battery of tests, including scans of facial movements and pupil dilation, for signs of deception. Small platforms similar to the balancing boards used [with] the Nintendo Wii would help detect fidgeting.

At a public demonstration of the system in Boston last year, project manager Robert Burns explained that people who harbor ill will display involuntary physiological reactions that others - such as those who are stressed out for ordinary reasons, such as being late for a plane - don't.

The system could be made to work passively, scanning people as they walk through a security line, according to Burns.

Field testing of the system, which will cost around $20 million to develop, could begin in 2011, The Boston Glove said in a story about the demonstration. Addressing one concern of civil libertarians, Burns said the technology would delete data after each screening.

The Israeli Model

Some say the U.S. should take a page from Israel's book on security.

At Israeli airports, widely considered the most secure in the world, travelers are subjected to probing personal questions as screeners look them straight in the eye for signs of deception. Searches are meticulous, with screeners often scrutinizing every item in a bag, unfolding socks, squeezing toothpaste and flipping through books.

"All must look to Israel and learn from them. This is not a post-911 thing for them. THey've been doing this since 1956," said Michael Goldberg, president of New York-based IDO Security Inc., which developed a device that can scan shoes while they are still on people's feet.

Israel also employs profiling: At Ben-Gurion Airport, Jewish Israelis typically pass through smoothly, while others may be taken aside for closer interrogation or even strip searches. Another digtinguishing feature of Israeli airports is that they rely on concentric security rings that start miles from terminal buildings.

Rafi Ron, the former security director at israel's famously tight Ben Gurion International Airport who now is a consultant for Boston's Logan International Airport, says U.S. airports also need to be careful not to overcommit to securing passenger entry points at airports forgetting about the rest of the field.

"Don't invest all your efforts on the front door and leave the back door open," said Ron.

While many experts agree the United Stated could adopt some Israeli methods, few believe the overall model would work here, in part because of the sheer number of U.S. airports - more than 400, versus half a dozen in Israel.

Also, the painstaking searches and interrogations would create delays that could bring U.S. air traffic to a standstill. And many Americans would find the often intrusive and intimidating Israeli approach repugnant.

Profiling

Some argue that policies against profiling undermine security.

Baum, who is also managing director of Green Light Limited, a London-based aviation security company, agrees profiling based on race and religion is counterproductive and should be avoided. But he argues that a reluctance to distinguish travelers on other grounds - such as their general appearance or their mannerisms - is not only foolhardy but dangerous.

"When you see a typical family - dressed like a family, acts like a family, interacts with each other like a family ... when their passport details match - then let's get them through," he said. "Stop wasting time that would be much better spent screening the people that we've got more concerns about."

U.S. authorities prohibit profiling of passengers based on ethnicity, religion or national origin. Current procedures call for travelers to be randomly pulled out of line for further screening.

Scrutinizing 80-year-old grandmothers or students because they might be carrying school scissors can defy common sense, Baum said.

"We need to use the human brain - which is the best technology of them all," he said.

But any move to relax prohibitions against profiling in the U.S. would surely trigger fierce resistance including legal challenges by privacy advocates.

Privatization

What if security were left to somebody other than the federal government?

Jim Harper, director of information policy studies at the Washington-based Cato Institute, a free-market-oriented think tank, says airlines should be allowed to take charge of security at airports.

Especially since 9/11, the trend has been toward standardizing security procedures to ensure all airports follow the best practices. But Harper argues that decentralizing the responsibility would result in a mix of approaches - thereby making it harder for terrorists to use a single template in planning attacks.

"Passengers, too, prefer a uniform experience," he said. "But that's not necessarily the best security. It's better if sometimes we take your laptop out, sometimes we'll pat you down. Those are things that will really drive a terrorist batty - as if they're not batty already."

Harper concedes that privatizing airport security is probably wishful thinking, and the idea has not gotten any traction. He acknowledges it would be difficult to allay fears of gaping security holes if it were left to each airline or airport owner to decide its own approach.

Scripting and the ISONAS System.

source: ISONAS

Script Programming supports Customized Actions

• Is there a need to have your ISONAS system initiate multiple advanced actions under certain conditions?

• Do you or your customers wish to receive email notifications when doors are left ajar or when ex-employees are attempting to re-enter the facilities?

These types of project requirements can easily be met through the Script Programming features application suite. Select the events you wish the system to monitor, and then specify what additional actions you would like the system to take when these events occur.

Schools Locking down their Facilities

 

A common use of Scripting is to configure the ISONAS system to place the exterior doors of a school into lock-down mode, when the administrators of the school require it. Scripts can be initiated in many ways, including by the use of specified credentials, or through the activiation of emergency mushroom buttons.

Additional common usages of scripting include the activation of the building's alarm system, or unlocking all entrances to a facility when a special event is beginning.



Email Notifications

Emails can be generated by the Crystal Matrix system, throught he Scripting feature. Example uses of the email notifications would include being notified of a networking failure, or being notified of an after-hours attempt to enter the facility.

Click here for more details on this solution.

Click here to visit the Kondor Security ISONAS page.

Click here to visit ISONAS.