- Border-surveillance subcontractor suspended after cyberattack -
Border-surveillance subcontractor Perceptics was suspended by The
U.S. Customs and Border Protection (CBP) after a cyberattack against
the firm revealed sensitive monitoring details.
The value of passwordless technology: Learning from the American
prohibition era - Say "password" today and the word will conjure up
visions of a laptop or an application � not secret societies. Still,
passwords have played an important role throughout human history to
distinguish between who could and couldn,t enter a specific area,
club or level of access to information.
Uber pays out $375K in bug bounties during challenge in London -
Uber laid out $375,000 to bug bounty hunters during a live hacking
event held in London with partner HackerOne.
Database management: The security checklist for every data-driven
deployment - Security threats have become a ubiquitous problem for
American companies, and reports find that damage related to
cybercrime is projected to hit $6 trillion annually by 2021.
According to Accenture, the most expensive component of a cyber
attack is data loss, which represents 43 percent of cybercrime
British Airways hit with record �183 million GDPR fine for last
year�s breach - The Information Commissioner�s Office (ICO) hit
British Airways with a record-breaking �183 million fine for last
year�s data breach that compromised the personal data of half a
Marriott hit with $124 million fine for 2018 data breach - The U.K.
Information Commissioners Office (ICO) intends to levy a
�99,200,396, or $124 million, fine against Marriott International in
response to the data breach suffered by that company�s Starwood
reservation data base in November 2018.
Coast Guard issues cyber recommendations to shipping industry - The
U.S. Coast Guard issued a marine safety alert recommending the
shipping industry institute basic cybersecurity measures to ensure
the safety of their vessels.
Record British Airways fine shows how data protection legislation is
beginning to bite - The ICO's proposed �183m fine should act as a
wake-up call for other organisations: make sure your cybersecurity
and data protection policies are GDPR-compliant - or you could be
Baltimore restores online payment systems for speeding and parking
tickets and property taxes - Baltimore officials said Wednesday that
people can once again pay property tax bills and parking tickets
online, although the city�s water billing system remains unavailable
about eight weeks after a ransomware attack took down the city�s
UK's largest police forensics lab paid ransom demand to recover
locked data - Eurofins Scientific has already recovered from the
incident. Didn't say how much it paid hackers.
U.S. mayors resolve to no longer pay ransomware attackers - The
United States Conference of Mayors issued a resolution at its 87th
annual meeting to stand united against paying ransoms when their
municipality is hit with a ransomware attack.
Cybercriminals are increasingly targeting the financial services
industry - Universally, consumers and small and large businesses
alike, are increasingly aware of the well-established fact that
cybercrime is on the rise.
ATTACKS, INTRUSIONS, DATA THEFT & LOSS
- Florida state worker steals resident�s PII - About 2,000 Florida
residents were potentially victimized by an employee of that state�s
Department of Children and Family Services (DFCS) who accessed and
used their PII to fraudulently make $260,000 in purchases.
Real estate group ALTA warns members of possible data breach - The
American Land Title Association (ALTA) on July 3 informed its
members, comprised of title insurance agents, abstracters and
underwriters, their usernames and passwords may have been acquired
by an unauthorized person.
ICE, FBI using driver�s license photos, without permission, for
facial recognition searches - Driver�s license photos have been
used, without users� permission, by agents with the FBI and
Immigration and Customs Enforcement (ICE) for facial recognition
Hackers breach Canonical GitHub account, create repositories, leave
source code untouched - Hackers compromised credentials to break
into a Canonical Ltd. GitHub account July 6 and created
repositories, but apparently did not lift sensitive information or
manipulate any source code.
Thieves steal $500K from users of 7-Eleven Japan�s new payment app -
Convenience chain 7-Eleven Japan has suspended a brand new mobile
cashless payment service after an authorized third party accessed
approximately 900 user accounts and made fraudulent charges totally
55 million yen, or roughly $500,000 dollars.
Cyberattack shuts down La Porte County (Indiana) government - La
Porte County, Ind., was hit with a cyberattack on July 6 that
knocked the county government�s systems offline.
Eurofins Scientific forensics firm pays after hit with ransomware -
Eurofins Scientific, the U.K.�s largest provider of forensic
services, paid up after a ransomware attack a month ago.
Automated Magecart campaign infects 962 online stores - A July 4
Magecart card-skimming attack successfully infiltrated 962 online
stores in what researchers are calling the largest 24-hour automated
Magecart campaign to date.
Canonical Investigating Hack of Its GitHub Page - Canonical Ltd., a
British company that offers commercial support and services for the
popular Ubuntu Linux open source operating system, is investigating
the hacking of its GitHub page over the weekend.
L.A. County Health Services Department contractor breach leaks
patient data - A data breach at a Los Angeles County Department of
Health Services contractor resulted in the compromise of data from
Return to the top
of the newsletter
WEB SITE COMPLIANCE -
We continue covering some of the
issues discussed in the "Risk Management Principles for Electronic
Banking" published by the Basel Committee on Bank Supervision.
Board and Management Oversight
13: Banks should have effective capacity, business continuity and
contingency planning processes to help ensure the availability of
e-banking systems and services.
To protect banks against business, legal and reputation risk,
e-banking services must be delivered on a consistent and timely
basis in accordance with customer expectations. To achieve this, the
bank must have the ability to deliver e-banking services to
end-users from either primary (e.g. internal bank systems and
applications) or secondary sources (e.g. systems and applications of
service providers). The maintenance of adequate availability is also
dependent upon the ability of contingency back-up systems to
mitigate denial of service attacks or other events that may
potentially cause business disruption.
The challenge to maintain continued availability of e-banking
systems and applications can be considerable given the potential for
high transaction demand, especially during peak time periods. In
addition, high customer expectations regarding short transaction
processing cycle times and constant availability (24 X 7) has also
increased the importance of sound capacity, business continuity and
contingency planning. To provide customers with the continuity of
e-banking services that they expect, banks need to ensure that:
1) Current e-banking system capacity and future scalability
are analyzed in light of the overall market dynamics for e-commerce
and the projected rate of customer acceptance of e-banking products
2) E-banking transaction processing capacity estimates are
established, stress tested and periodically reviewed.
3) Appropriate business continuity and contingency plans
for critical e-banking processing and delivery systems are in place
and regularly tested.
the top of the newsletter
FFIEC IT SECURITY -
We continue our series on the FFIEC
interagency Information Security Booklet.
SECURITY CONTROLS -
Many financial institutions use modems, remote - access servers
(RAS), and VPNs to provide remote access into their systems or to
allow remote access out of their systems. Remote access can support
mobile users through wireless, Internet, or dial-in capabilities. In
some cases, modem access is required periodically by vendors to make
emergency program fixes or to support a system.
Remote access to a financial institution's systems provides an
attacker with the opportunity to remotely attack the systems either
individually or in groups. Accordingly, management should establish
policies restricting remote access and be aware of all remote access
devices attached to their systems. These devices should be strictly
controlled. Good controls for remote access include the following
! Disallow remote access by policy and practice unless a
compelling business justification exists.
! Disable remote access at the operating system level if a
business need for such access does not exist.
! Require management approval for remote access.
! Require an operator to leave the modems unplugged or disabled by
default, to enable modems only for specific, authorized external
requests, and disable the modem immediately when the requested
purpose is completed.
! Configure modems not to answer inbound calls, if modems are for
outbound use only.
! Use automated callback features so the modems only call one
number (although this is subject to call forwarding schemes).
! Install a modem bank where the outside number to the modems uses
a different prefix than internal numbers and does not respond to
! Log and monitor the date, time, user, user location, duration,
and purpose for all remote access.
! Require a two-factor authentication process for all remote
access (e.g., PIN-based token card with a one-time random password
! Implement controls consistent with the sensitivity of remote use
(e.g., remote system administration requires strict controls and
oversight including encrypting the authentication and log-in
! Appropriately patch and maintain all remote access software.
! Use trusted, secure access devices.
! Use remote-access servers (RAS) to centralize modem and Internet
access, to provide a consistent authentication process, and to
subject the inbound and outbound network traffic to firewalls.
Return to the top of
NATIONAL INSTITUTE OF STANDARDS
AND TECHNOLOGY -
the series on the National Institute of Standards and Technology
Chapter 20 -
ASSESSING AND MITIGATING THE RISKS TO A HYPOTHETICAL COMPUTER SYSTEM
Protection Against Payroll Fraud and Errors: Time and Attendance
Application (2 of 2)
The frequency of data
entry errors is reduced by having Time and Attendance clerks enter
each time sheet into the time and attendance application twice. If
the two copies are identical, both are considered error free, and
the record is accepted for subsequent review and approval by a
supervisor. If the copies are not identical, the discrepancies are
displayed, and for each discrepancy, the clerk determines which copy
is correct. The clerk then incorporates the corrections into one of
the copies, which is then accepted for further processing. If the
clerk makes the same data-entry error twice, then the two copies
will match, and one will be accepted as correct, even though it is
erroneous. To reduce this risk, the time and attendance application
could be configured to require that the two copies be entered by
In addition, each
department has one or more Time and Attendance Supervisors who are
authorized to review these reports for accuracy and to approve them
by running another server program that is part of the time and
attendance application. The data are then subjected to a collection
of "sanity checks" to detect entries whose values are outside
expected ranges. Potential anomalies are displayed to the supervisor
prior to allowing approval; if errors are identified, the data are
returned to a clerk for additional examination and corrections.
When a supervisor
approves the time and attendance data, this application logs into
the interagency mainframe via the WAN and transfers the data to a
payroll database on the mainframe. The mainframe later prints
paychecks or, using a pool of modems that can send data over phone
lines, it may transfer the funds electronically into
employee-designated bank accounts. Withheld taxes and contributions
are also transferred electronically in this manner.
The Director of
Personnel is responsible for ensuring that forms describing
significant payroll-related personnel actions are provided to the
Payroll Office at least one week before the payroll processing date
for the first affected pay period. These actions include hiring,
terminations, transfers, leaves of absences and returns from such,
and pay raises.
The Manager of the
Payroll Office is responsible for establishing and maintaining
controls adequate to ensure that the amounts of pay, leave, and
other benefits reported on pay stubs and recorded in permanent
records and those distributed electronically are accurate and
consistent with time and attendance data and with other information
provided by the Personnel Department. In particular, paychecks must
never be provided to anyone who is not a bona fide, active-status
employee of HGA. Moreover, the pay of any employee who terminates
employment, who transfers, or who goes on leave without pay must be
suspended as of the effective date of such action; that is, extra
paychecks or excess pay must not be dispersed.
Accidental Corruption or Loss of Payroll Data
The same mechanisms
used to protect against fraudulent modification are used to protect
against accidental corruption of time and attendance data -- namely,
the access-control features of the server and mainframe operating
Operations Group) nightly backups of the server's disks protect
against loss of time and attendance data. To a limited extent, HGA
also relies on mainframe administrative personnel to back up time
and attendance data stored on the mainframe, even though HGA has no
direct control over these individuals. As additional protection
against loss of data at the mainframe, HGA retains copies of all
time and attendance data on line on the server for at least one
year, at which time the data are archived and kept for three years.
The server's access controls for the on-line files are automatically
set to read-only access by the time and attendance application at
the time of submission to the mainframe. The integrity of time and
attendance data will be protected by digital signatures as they are
communications protocols also protect against loss of data during
transmission from the server to the mainframe (e.g., error
checking). In addition, the mainframe payroll application includes a
program that is automatically run 24 hours before paychecks and pay
stubs are printed. This program produces a report identifying
agencies from whom time and attendance data for the current pay
period were expected but not received. Payroll department staff are
responsible for reviewing the reports and immediately notifying
agencies that need to submit or resubmit time and attendance data.
If time and attendance input or other related information is not
available on a timely basis, pay, leave, and other benefits are
temporarily calculated based on information estimated from prior pay