Strict Controls Proposed on the Export of Cybersecurity Items

On May 20, 2015, the Commerce Department Bureau of Industry and Security (BIS) proposed to establish controls on the export of cybersecurity items. These items would be classified under new Export Control Classification Numbers (ECCNs) in Categories 4 and 5 of the Export Administration Regulations (EAR) that would be subject to Regional Stability (RS) controls, which require licenses for all countries except Canada and generally are not eligible for license exceptions. If the proposed rules are implemented, strict licensing requirements would be imposed on the export of these items, even those that companies may themselves legitimately seek to obtain to test how vulnerable their networks may be to cyberattacks.

Under the proposed rule, BIS considers the following to be cybersecurity items:

1. systems, equipment or components specially designed for the generation, operation or delivery of, or communication with, intrusion software;
2. software specially designed or modified for the development or production of such systems, equipment or components;
3. software specially designed for the generation, operation or delivery of, or communication with, intrusion software;
4. technology required for the development of intrusion software; and
5. Internet Protocol (IP) network communications surveillance systems or equipment and test, inspection, production equipment, specially designed components therefor, and development and production software and technology therefor.

The term “intrusion software” is defined, e.g., as software specially designed or modified to avoid detection by monitoring tools, or to defeat protective countermeasures. “Monitoring tools” are defined as software or hardware tools that monitor system behaviors processes running on a device, and “protective countermeasures” are defined as techniques designed to ensure the safe execution of code.

In proposing these changes, BIS is seeking to implement agreements made in December 2013 by the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Technologies (Wassenaar Arrangement). The Wassenaar Arrangement is a group of 41 countries that seek to promote harmonization of export controls by adopting similar lists of controlled items. Once changes are agreed to, participants such as the United States are expected to follow through with making such changes to their own national export control lists.

BIS acknowledges that the items it proposes to regulate under the new cybersecurity controls “include network penetration testing products that use intrusion software to identify vulnerabilities of computers and network-capable devices.” Currently, certain of these items are controlled for export as encryption items because of their information security functionality. However, under License Exception ENC, most encryption items can be freely exported except to embargoed countries after registering with BIS, filing a classification request and undergoing a 30-day waiting period. The principal exception is a category of certain “restricted products,” e.g., network infrastructure items, which require a license if exported to foreign government customers in countries outside the list contained at Supplement No. 3 to Part 740 of the EAR.

Under the proposed rule, if cybersecurity items implement encryption, exporters will still have to comply with License Exception ENC’s requirements. But rather than resulting in export authorization, fulfilling these steps will simply be prerequisites to applying for an export license, which will be required for all countries except Canada. Exporters who believe their items are subject to the encryption controls should exercise caution, to avoid a situation in which they export and then learn after the fact that BIS actually believes the items are subject to the new cybersecurity controls.

Also, License Exception ENC permits the export of encryption items to subsidiaries of U.S. companies without prior authorization. However, the proposed cybersecurity controls would still require an export license in those instances. This restriction will potentially complicate deployment of cybersecurity items by U.S.-based multinational corporations even for protective purposes within the corporate family.

Companies across the globe, particularly U.S.-based companies operating overseas, are constantly under cyber-attack. It is vital that they have the best cybersecurity system possible in place, which requires regular and rigorous testing of those defenses. It may prove difficult to strike the right balance between preventing cybersecurity items from falling into the wrong hands to conduct cyberattacks and allowing companies legitimate access to them so they can test their cyber defenses.

Comments to the proposed rule are due by July 20, 2015. In particular, BIS is seeking comments, e.g., on to what degree the proposed rule would increase the number of license applications companies would have to make and whether it would have negative effects on a company’s ability to protect its own networks. Nonetheless, as BIS is required to implement the multilateral Wassenaar Arrangement agreement, there may be limited opportunity to make significant changes to the proposed rules before they go into effect.

View the original content and more from this author here: http://ift.tt/1d6ChIY

from cyber security caucus http://ift.tt/1EOR3tY
via IFTTT

Surveillance reform could tee up cyber bill

Supporters of cybersecurity reform are hoping a breakthough on the Patriot Act could pave the way for the Senate to consider their prized legislation.

Getting a surveillance reform measure through the Senate might assuage some of the privacy concerns that have held up cybersecurity legislation in the upper chamber, say supporters of the bill.

“If a deal is reached, it may in fact improve the chances of cybersecurity legislation coming through,” said Jim Penrose, a former head of the National Security Agency’s Operational Discovery Center who is now an executive vice president at cybersecurity firm DarkTrace.

The Senate has been trying to move a bill that would shield companies from legal liability when sharing cyber threat data with the government.

Backers of the Cybersecurity Information Sharing Act (CISA) say exchanging more information on hackers will help the public and private sector harden network defenses that have been repeatedly breached over the last year.

A bipartisan group of lawmakers, government officials and most major industry groups are supporting the bill.

But civil liberties groups and several lawmakers believe the offering would simply shuttle more personal data to the National Security agency, further empowering its surveillance program.

The House passed two companion pieces of legislation back in April, but CISA has been mired in the upper chamber, lost amid the heated debate over re-writing the Patriot Act and reforming the NSA programs.

“I don’t think cyber information-sharing legislation is in any way off the table,” said Paul Martino, senior policy counsel at the National Retail Federation, which supports CISA. “I think it is just being held up right now in a traffic jam.”

Senators will try to clear up that traffic jam this weekend as they head back to D.C. for a rare Sunday session.

Most reformers are backing the House-passed USA Freedom Act, which would reign in the NSA’s more controversial surveillance programs.

If senators can get the USA Freedom Act passed before midnight Sunday — it’s three votes shy of reaching the 60-vote threshold needed to overcome a filibuster — CISA might be teed up next.

“Cyber info sharing seems like the next most likely issue to come up,” said Norma Krayem, a lobbyist with Squire Patton Boggs who co-chairs the firm’s cybersecurity industry group.

Getting the USA Freedom Act through Congress could win over some additional votes for CISA.

“If something can pass on surveillance does that mean it helps in terms of getting enough votes to pass information sharing? Yes, I think so,” Martino said.

In addition to ending the NSA’s bulk collection of telephone metadata, USA Freedom would institute more accountability mechanisms. It would institute a panel to advise the Foreign Intelligence Surveillance Court, which oversees intelligence agencies, on cases that may infringe on people’s privacy or civil liberties. The bill would also boost public reporting about the NSA’s spying programs.

Penrose believes senators who are worried CISA would embolden the NSA “may in fact take some piece of mind” from these privacy oversight provisions.

But the vitriolic debate that has caused the Senate to go down to the wire on the Patriot Act could also extend to the upcoming CISA discussion.

“It is inevitable that there will be spillover from this debate into the cyber debate, despite the fact that many of them had hoped to keep it separate,” Krayem said. “And if the cyber info sharing bill is the next one, then that debate could be much stickier.”

And no Patriot Act reform will truly mitigate all the privacy concerns floating around CISA.

“CISA could actually result in the kind of bulk surveillance activity that USA Freedom is intended to stop,” said Gabe Rottman, legislative counsel and policy advisor for the American Civil Liberties Union, which opposes CISA. “Once information flows from the private sector to the government, the military and intelligence community could store and mine it for purposes that go far beyond ‘cybersecurity.’”

Krayem believes the Senate could help tamp down these fears by tacking a data security bill onto CISA.

Several similar data security bills are floating around the Senate right now. All would set nationwide cybersecurity standards for companies handling sensitive information. Several of the measures have bipartisan support.

“If you think about the core basics in each of those bills, there’s a focus on privacy issues,” Krayem said. “It seems like that could be a very useful thing to please both sides of the aisle.”

Of course, all these plans could fall apart if the Senate lets the Patriot Act expire. Then lawmakers enter uncharted territory and CISA is likely to get further delayed.

“In some regards, it may make more time to concentrate on cyber,” Penrose said.

The Patriot Act is somewhat outdated, he said. It doesn’t necessarily map well to today’s Internet-connected world.

Having the law expire, he added, might allow lawmakers to “turn to the next phase of where our national security concerns lie.”

View the original content and more from this author here: http://ift.tt/1Fjdw2V

from cyber security caucus http://ift.tt/1KIaMDW
via IFTTT

Former White House Staffer To Speak In Bermuda

One of America’s most respected authorities on Internet security, former White House chief information officer Theresa Payton, will give the keynote speech at next week’s annual Bermuda Captive Conference [June 8–10], of which the Bermuda Business Development Agency [BDA] is a supporting sponsor.

“Payton served at the White House under George W. Bush from 2006-08, the first woman to hold the position, administering information technology oversight for the president and 3,000 staff members,” the BDA said.

“With previous executive roles in banking technology at Bank of America and Wells Fargo, Payton is a cyber-security authority and expert on identity theft and the Internet of Things [IoT]. She currently advises organisations on improving their IT systems against cyber threats, through her company Fortalice LLC.

“Payton’s speech, scheduled for noon, Tuesday, June 9 at the Fairmont Southampton, is titled “Big Data and the Internet of Things: Boon or Bust for your Cyber Security Efforts?” She will discuss marketing databases, customer analytics, and protecting data elements from hackers, as well as how IoT will drive global change.

“The three-day conference, to be officially opened by Bermuda’s Premier Michael Dunkley at 2:30 pm Monday, June 8, is expected to attract some 650 delegates from Bermuda and overseas, according to organisers. A wide spectrum of captive insurance management firms, as well as support industries, are sponsoring the event.

“As well as the Premier’s opening address and Payton’s keynote speech, highlights include round-table discussions by expert panellists, informational sessions on trends and hot topics in the captive insurance industry, and networking events including a nature walk, golf tournament, and beach barbecue.

“Some 138 inductees to a new “Captive Hall of Fame”—honouring companies active in the Island’s captive sector over the past quarter-century—will also be recognised and presented with certificates by Premier Dunkley after his opening remarks.”

“The Bermuda Captive Conference recognises the important relationship between captives and Bermuda as a leading domicile,” said Tom McMahon, BCC Chairman. “This award is designed to acknowledge the loyalty and commitment of these companies to making Bermuda the world’s number-one domicile for captive insurance.”

The BDA added, “Bermuda is the top global captive jurisdiction, home to more than 800 captive insurance companies, supporting primarily Fortune 500 corporations in the US, and generating over $20 billion in annual gross written premiums.

“Notably, Bermuda-based captives support an estimated 25 percent of the American medical insurance and reinsurance market, and a growing number are originating from Canada and Latin America in recent years.

“Monday’s [June 8] opening round-table at 2:45 pm will feature Robert Paton, President of the Bermuda Insurance Management Association [BIMA]; Robert Vermes, President of the Bermuda Captive Owners Association [BCOA]; Jeremy Cox, CEO, Bermuda Monetary Authority [BMA]; ET [Bob] Richards, Minister of Finance; and Brad Kading, President and Executive Director of the Association of Bermuda Insurers & Reinsurers [ABIR].

“Speciality sessions throughout the event will focus on a wide range of industry issues, including re-structuring and re-domiciling; inter-company loans between captives and parents; healthcare captives; investment opportunities; group captives; segregated accounts; global fronting; emerging risks; and Bermuda as a domicile for LatAm captives.

View the original content and more from this author here: http://ift.tt/1EOAezs

from cyber security caucus http://ift.tt/1EOAazJ
via IFTTT

Cybersecurity lapses at trading giants exposed

Banks and brokers are putting themselves at risk of costly cyberattacks by neglecting basic security when trading, a leaked industry poll shows.

View the original content and more from this author here: http://ift.tt/1KGnqDv

from cyber security caucus http://ift.tt/1BD1Qax
via IFTTT

‘Complex beyond anyone’s understanding': a brief history of internet security

The internet grew from the work of many people over several decades. Few predicted how essential it would become to our lives or the ways that it would make us more vulnerable to scam artists, snoops and spies. Here are some of the milestones in the development of our insecure online world.

A new kind of network,1960

Engineer Paul Baran argues that a decentralised communications system with many redundant links could help the United States recover from a Soviet nuclear attack. The key is that information can flow across many different paths — much like today’s internet — allowing connections even if much of the overall system suffered damage.

Leonard Kleinrock stands next to a specialised computer — a forerunner to today’s routers — that sent the first message over the internet in 1969. Photo: Bret Hartman / The Washington Post

Key idea: By distributing the connections in a system, it becomes more resilient in the face of outages.

Packet switching theory, 1968

Donald Davies, a top official with Britain’s National Physical Laboratory, describes a system for chopping data into smaller pieces to make transmissions more efficient. He calls the pieces “packets” and the technology for transmitting them “packet-switching.” The idea remains an essential technology of the internet.

Vinton Cerf designed key building blocks of the internet in the 1970s and 80s. Now a Google executive, he says he wishes he had been able to build encryption into TCP/IP from the beginning. Photo: Bill O’Leary / The Washington Post

Key idea: Several users can share a single packet-switched line, allowing for better use of scarce computing resources.

Precursor to the internet , 1969

The Pentagon’s Advanced Research Projects Agency designs and funds a packet-switched network called the ARPANET — considered the most important precursor to the internet. The first ARPANET message is sent at 10.30pm on October 29, 1969, from the UCLA computer lab of Leonard Kleinrock, a networking pioneer.

An early warning, 1973

Robert Metcalfe, an engineer who would later found hardware maker 3Com, warns the ARPANET Working Group that it is far too easy to gain access to the network. One of several intrusions he describes apparently was the work of high school students.

A road not taken, 1978

Computer scientists Vinton Cerf and Robert Kahn attempt to build encryption technology directly into TCP/IP, a set of protocols that will give rise to the internet several years later. But the scientists run into a series of obstacles, including resistance from the US National Security Agency.

Birth of the internet, 1983

ARPANET requires its network users to communicate via TCP/IP, quickly making it the global standard. Networks all over the world can now communicate easily with each other, creating the internet.

Key idea: Standardising the way networked machines communicated with each other enabled the internet’s massive growth.

Computer Fraud and Abuse Act, 1986

US congress enacts a comprehensive bill establishing legal sanctions against data theft, unauthorised network access and some other computer-related crimes.

The Morris Worm, 1988

A Cornell University graduate student named Robert Tappan Morris releases several dozen lines of code, which replicate wildly and spread to thousands of computers worldwide. The worm crashes about 10 per cent of the 60,000 computers linked to the internet. Morris becomes the first person convicted by a jury under the Computer Fraud and Abuse Act.

(Internet) power to the people, 1993

The first browser, Mosaic, is released, allowing users with little or no technical skill to browse the world wide web. This fuels a new period of massive growth of the internet and also the commercialisation of cyberspace. As the community of online users grows, so do security threats.

The web becomes animated, 1996

New drawing and animation tools, such as Macromedia’s Flash, dramatically expand the abilities of browsers. This revolutionises the look and feel of websites. Hackers soon discover that these web tools also can allow them to take remote control of computers on the internet, no matter where they are in the physical world.

Security concern: Flash and other browser add-ons have been a major source of security flaws, with some experts recommending that users disable them entirely.

Insecurity spreads, 2000

A rash of new computer worms, such as ILOVEYOU, spread wildly across the internet, taking advantage of security flaws in widely used software made by Microsoft and other major tech companies. Tens of millions of computers are affected.

No longer a fad, 2003

The amount of data created in this year surpasses the amount of all information created in the rest of human history combined. The internet has become so central to commerce and culture worldwide that the opportunities for hackers grow.

Security concern: The more devices using the internet, the more entry points there are for attacks, and the more difficult it becomes to overhaul how the system works.

The internet in your pocket, 2007

The introduction of Apple’s iPhone fuels the rise of mobile devices. Smartphones running Google’s Android operating system hit the market the following year. This heralded a new era of snooping, as police, spies and even jealous spouses find ways to monitor people through powerful personal computers doubling as phones.

Internet is deemed complex, unpredictable, 2010

A group of the nation’s top scientists conclude in a report to the Pentagon that “the cyber-universe is complex well beyond anyone’s understanding and exhibits behaviour that no one predicted, and sometimes can’t even be explained well.” The scientists, part of a Pentagon advisory group called JASON, say, “In order to achieve security breakthroughs we need a more fundamental understanding of the science of cybersecurity.”

Car hacking, 2014

Security researchers publish a guide to hacking automobiles, revealing deep flaws in the way automobile electronics communicate with each other. Massachusetts senator Ed Markey’s office shortly thereafter finds that nearly all “cars on the market include wireless technologies that could pose vulnerabilities to hacking or privacy intrusions”.

View the original content and more from this author here: http://ift.tt/1M4hZfr

from cyber security caucus http://ift.tt/1Q00a77
via IFTTT

5 things you won’t be hearing at Infosecurity Europe 2015 in London next week

CBR gives you the inside line on what the industry won’t be telling you.

Infosecurity Europe, the biggest cybersecurity conference on the whole of the continent, will be rolling into London next week and bringing with it a host of hackers, coders and spooks.

On the agenda this year is everything from prevention to response, with plenty of discussions of malware, cyberespionage and data protection along the way.

But ahead of the conference, what will you not be hearing from the cybersecurity industry as it seeks to flog you more tin and set up you with its friends in consulting?

1. GCHQ: We value your privacy more than security

The revival of the Snooper’s Charter (or to use its official name: the Investigatory Powers Bill) comes after a series of battles between the cybersecurity industry and the British and American governments.

Whilst the US looks to have quashed many of its spies’ powers in ongoing debates over the Patriot Act, the home secretary Theresa May looks likely to endow GCHQ in Cheltenham with even more toys to play with in the battle against “extremists” and other miscreants.

That in mind when Ciaran Martin, director general of cybersecurity at GCHQ , kicks off the conference with the opening keynote, do not expect the spook to be too worried about the damage his new powers could cause to privacy.

2. Security vendors: Don’t worry and be happy

Longtime readers of CBR will be used to doom-laden headlines as hackers become ever more ingenious and strike even deeper into corporate networks, such as those at corporate leviathans as US retailer Target, the bank JP Morgan and the auction site eBay.

Even with all the money pouring into the cybersecurity industry we cannot expect many of these attacks to let up in the near future. Recalling his firm’s predictions for this year Raj Samani, CTO at Intel Security EMEA, struck a pessimistic note likely to be common at the conference.

“Long-term players will become stealthier information gatherers,” he said. “Sophisticated cybercriminals will shift from quick attacks to intelligence gathering. Newcomers will look for ways to steal money and disrupt their adversaries.”

3. ‘On no account should you move to the cloud.’

Silicon Valley has increasingly been accused of frothiness as market evaluations for three-week-old start-ups stretch into the millions, but its enthusiasm for the cloud makes “fluffy” an equally apt description.

As far as security goes the use of the cloud – or in the words of Samani, “somebody else’s computer” – has left many a CIO jittery. For some reason the idea of keeping sensitive data outside of the building is concerning to a great many, even if the industry in general loves the cloud.

Bob Tarzey, a director at research firm Quocirca, thinks the latter view is correct. “In the background, the message that actually many cloud infrastructure and application services are far more secure than many have credited should be getting through,” he said. ” In fact, in many cases they are far more secure than on-premise deployments.”

4. John McAfee will affirm his faith in the government

Since leaving the company that used to bear his name (now called Intel Security), John McAfee has cut a controversial figure, having to quickly vacate Belize in Central America after his neighbour was found dead in 2012.

He is also infamous for having attacked McAfee in a rather bizarre video released on YouTube, and more recentlycriticised Google for its corrosive effect on privacy at the Def Con conference in Las Vegas last year.

“Google or at least certain people within Google – I will not mention names because I am not a rude gentleman – would like us to believe that if we have nothing to hide we should not mind if everybody knows everything that we do,” he said at the time. Do not expect him to relent this time round.

5. ‘You don’t need any more of our gear.’

Many of the big security vendors are doing their best to convert customers to the benefits of better planning when it comes to cybersecurity, simultaneously decrying the focus on technology that characterises their younger rivals.

Even so, Infosecurity is among the best opportunities many of them will get to sell you some more gear, and don’t expect them to miss it. Already Gemalto and Norse have announced plans to showcase new products – and they won’t be the only ones.

View the original content and more from this author here: http://ift.tt/1LWWkoW

from cyber security caucus http://ift.tt/1PZQGc3
via IFTTT

NERC CIP v5 Suggests Compliance Does Not Equal Security

OVERLAND PARK, KS–(Marketwired – June 01, 2015) – What’s the difference between compliance and security? One might think being compliant also means being secure. There is perhaps no bigger misconception in the information security world.

What should be understood is that compliance with whatever regulations your organization must follow should be the byproduct of a solid security program. Compliance should be viewed as a retrospective “check box” approach to threat mitigation. Security would be all prospective actions that are in flux as the landscape of threats changes. Those who believe compliance rewards them with ample security are flirting with the threat of being breached.

NERC’s Critical Infrastructure Protection standards takes this understanding into account. The upcoming Version 5 standards will require compliance with standards that increase awareness of security. In particular:

• CIP-003-5: Cybersecurity Management Controls
  This standard requires all responsible entities to review documented cybersecurity policies that pertain to CIP standards and also obtain verification/approval every 15 months.
• CIP-004-5: Cybersecurity – Personnel and Training
  This standard requires documented processes and programs that augment cybersecurity awareness, including cybersecurity training, personnel risk assessment, and access management.
• CIP-008-5: Cybersecurity – Incident Reporting and Response Planning
  This standard requires organizations to provide a documented cybersecurity incident response plan.What’s more, each standard requires periodic testing (every three to 15 months, depending on the standard) and evaluation to ensure security awareness is optimal.

  These standards, with their requirements of documentation, assessment, and processes, are a lot to juggle, especially when you factor in the seven other standards involved with CIP v5. An automated risk management and compliance solution, like LockPath’s Keylight, can take the manual, laborious processes out of complying with any and all CIP standards. Focusing solely on the three aforementioned standards dealing with security awareness, a risk management and compliance solution can:

  1) Schedule awareness events for policy review and gain verification/approval through documented, time stamped workflow;
  2) Centralize the documentation of training activities and personnel completion, automate delivery of assessments, and score risk based on results of assessments; and
  3) Track all security and compliance incidents including investigatory and remediation efforts via workflow with the ability to document deviations and lessons learned.

  Compliance means you won’t be fined. Security means you won’t end up in the headlines. A friendly security suggestion would be to look beyond CIP compliance and use it as a baseline for your security policies.

  About LockPath
  LockPath is a market leader in corporate governance, risk management, regulatory compliance (GRC) and information security (InfoSec) software. The company’s flexible, scalable and fully integrated suite of applications is used by organizations to automate business processes, reduce enterprise risk and demonstrate regulatory compliance to achieve audit-ready status. LockPath serves a client base of global organizations ranging from small and midsize companies to Fortune 10 enterprises in more than 15 industries. The company is headquartered in Overland Park, Kansas.

View the original content and more from this author here: http://ift.tt/1GgrHwz

from cyber security caucus http://ift.tt/1FlSHDY
via IFTTT