Surge In Security Newbs Predicted

"IT professionals are placing their bets on security as they plot their next career moves, according to a new study published earlier today.

"The survey of more than 1,500 IT workers, which was conducted by the IT trade association CompTIA, found that 37 percent intend to pursue a security certification over the next five years. Another 18 percent of IT workers said they will seek ethical hacking certifications during the same time period, while 13 percent identified forensics as their next certification target.

"`Given the growing reach of security, with threats becoming more pervasive and dangerous and with no business or industry immune to those threats, it makes sense that many IT professionals view this as a must-have for career advancement,` said Terry Erdle, senior vice president, skills certifications for CompTIA."

More at DarkReading...

Savvy Workers Resist Facebook Fad

"When CIO Will Weider encouraged employees at Ministry Health Care and Affinity Health System in Wisconsin to use Facebook to spread the word about new programs and successful projects, he was surprised at the result: Few did so.

"`I went in there thinking, 'We've turned these people loose; we'll have 10,000 marketers out there,'` Weider says. But the Ministry Health workforce, it turned out, had been well trained to protect sensitive data, and without explicit guidance on what they could say, their first reaction was to share nothing.

"`We've stressed the importance of data security with our employees, particularly when it comes to patient privacy, and it's kept them from sharing all the great things about work on Facebook,` Weider says.

"That's a good problem to have. Many fear that the popularity of social networking -- among individuals as well as organizations -- will precipitate an increase in social engineering attacks that could result in security breaches that expose corporate data or damage a company's reputation."

More at NetworldWorld...

IT Vendors Are EVIL

"When patients visit a physician or hospital, they know that anyone involved in providing their health care can lawfully see their medical records.

"But unknown to patients, an increasing number of outside vendors that manage electronic health records also have access to that data, and are reselling the information as a commodity.

"The revelation comes in a recent New York Times article about how so-called `scrubbed` patient data isn’t as anonymous as people think. The piece focuses primarily on how anonymized data can be cross-bred with other publicly available databases, such as voting records, which subverts the anonymity. Buried near the end of the article is the news that medical data is collected, anonymized and sold, not by insurance agencies and health care providers, but by third-party vendors who provide medical-record storage in the cloud."

More at Wired...

70% Of Banks Hacked From The Inside

"A former Wachovia Bank executive who had handled insider fraud incidents says banks are in denial about just how massive the insider threat problem is within their institutions. Meanwhile, the economic crisis appears to be exacerbating the risk, with 70 percent of financial institutions saying they have experienced a case of data theft by one of their employees in the past 12 months, according to new survey data.

"Shirley Inscoe, who spent 21 years at Wachovia handling insider fraud investigations and fraud prevention, says banks don't want to talk about the insider fraud, and many aren't aware that it's an `epic problem.`

"`There needs to be more training around this issue,` says Inscoe, who co-authored a book about bank insider fraud called Insidious -- How Trusted Employees Steal Millions and Why It's So Hard for Banks to Stop Them, which publishes later this month. `We are seeing a huge increase in this country of organized crime rings threatening individuals who work in financial institutions and making them [commit fraud on their behalf],` she says."

More at dark reading...

IT Employee Of The Week

"In a twist of Alanis Morrissettian irony, a man serving a six-year prison sentence for stealing millions of dollars through online credit card fraud recently succeeded in (surprise!) hacking into his prison's computer network, effectively paralyzing the entire system. The really incomprehensible part, though, is that officials at Ranby Prison, close to Retford, Nottinghamshire, England, gave him access to the computer.

"Apparently in dire need of an internal TV station at the facility, officers decided against hiring a third party (e.g., not a convicted hacker) to set up the system. They instead opted to keep the operation in (the Big) house, delegating the duty to one Douglas Havard. So, as convicted hackers are wont to do, Havard, left unguarded, worked his way into the prison's hard drive, and set up a labyrinth of passwords to lock everyone else out of the system....."

More at switched.com...

Coffee Shack Hack

"One day last August, the Secret Service paid a visit to the new owners of Custom House Coffee off West Main Road.

"The news they brought was bad: Computer hackers, whereabouts unknown, had used sophisticated spy software to break into the store’s wireless network and steal the credit and debit card numbers of customers.

"In all, about 50 customers of Custom House Coffee had been victimized, as early as May 2008, according to Police Chief Lance Hebert. But it wasn’t until the victims got their bank or credit card statements and saw charges they didn’t recognize that they realized they had been robbed. As the police reports started to filter in, detectives began connecting the dots..."

More at projo.com...

Talking Heads Bemoan State Of IT Security

"This is the worst time in recent memory for potential security breaches, according to a British Computer Society video debate.

"IT security should remain one of the highest priorities during the economic downturn, especially for companies that may have to make redundancies over the coming months, the BCS debate concluded.

"The Financial Services Authority (FSA) has urged firms to keep on top of operational controls and risk management because of the danger that criminals may target increasingly desperate employees.

"As they are under financial and job pressures as the downturn deepens, they may be tempted to commit data theft, among other crimes.

"The video debate panel, which comprised Rik Ferguson of security firm Trend Micro, Hamid Jahankhani of the University of East London, and Louise Bennett of the BCS Security Forum, agreed that large organisations need a better understanding of which specific person has access to what information."

More at ComputerWeekly...

Hacking The Dead

"Two Samaritan North Health Center employees indicted on identity theft and money laundering charges used information from deceased patients to apply for online loans, police said Friday, Dec. 26.

"Linda McDermott-Dorsey and Lisa Kidd, both of Trotwood, were indicted Dec. 23. McDermott-Dorsey is charged with 11 counts of money laundering and one count of identity theft, Kidd with 19 counts of money laundering and one of identity theft.

"Englewood Police Sgt. Mike Lang said Samaritan North Health Center did an internal investigation and then called police, after being contacted by an on-line loan company the women are accused to trying to swindle...

"Lang said the women allegedly obtained a little more than $7,000 using information from 24 people over about a five week period, May-June 2007. They checked newspaper obituaries and used the hospital computer system to gather the personal information of deceased persons who had been Good Samaritan Hospital patients, Lang said.

"The money laundering charges stem from online bank accounts opened and used to transfer funds."

From the Dayton Daily News...

Insiders Pose New Threats In Down Economy

By Tim Wilson
DarkReading

Rene Rebollo was strapped for cash. One day, while working in his office at the Pasadena branch of Countrywide Home Loan, he noticed one computer in the building whose USB port hadn't been disabled by the company's IT department. Then, according to FBI affidavits, Rebollo got an idea.

Every Sunday night for approximately two years, Rebollo went over to that workstation and downloaded confidential data on as many as 20,000 Countrywide customers to a small USB drive that he could carry out of the office in his pocket. He then sold the valuable data for as little as $500 to an accomplice, who fenced it. Over the two-year period, Rebollo may have sold as many as 2 million records, according to some estimates.

More at DarkReading...