In this month's issue of our Security Watch Newsletter, we discuss the merits of using Defence in Depth to protect your information assets, we dispel four commonly held myths relating to information security, highlight some interesting free tools to help you monitor your network, outline how to collect digital evidence and provide guidelines on how to protect yourself from social engineering.  We also highlight some interesting news stories from around the globe and update you on the latest happenings in BH Consulting

Internet Fraud is on the Increase.
As mentioned above, the Internet Crime Complaint Center's (IC3) 2005 Internet Crime Report demonstrates that Internet fraud is on the increase. Together with other reports, such as Symantec's Internet Threat Report and the UK's Department of Trade and industry's 2006 Security Breaches Survey, there are clear indications that organised criminals are becoming more and more involved in Internet crime and are targeting smaller companies and individuals for financial gain.

The anonymous nature of the Internet makes it an ideal location for criminals to conduct their business in relative anonymity, target thousands of users with one email and indeed can set up scams that look quite convincing and genuine.   The added attraction for criminals is that it can be quite difficult for the police to prosecute them as it often involves having to deal with cross jurisdictional issues.  The perception of safety many people feel when using the Internet also adds to the problem.  Most people would never contemplate giving their credit card details to a complete stranger on the street or would be very wary of buying something from someone they never met before.  But when sitting at a computer screen in the safety of their workplace or home they seem to feel that the safety of their physical environment extends to the online world.

Individuals are not the only people who need to be concerned about online fraud.  A number of BH Consulting's corporate clients have recently had issues whereby fake scam emails are being sent to people allegedly originating from their company.  While this may not result in direct financial loss to the company, it results in reputational damage and losses in terms of time and resources dealing with enquiries from victims of the scam.

Individuals should take extra care and precautions when conducting any business online and adhere to the old adage, "If it is too good to be true, then it probably is too good to be true."  Companies should also include how to deal with Phishing attacks and other scams conducted in their name as part of their overall Incident Response Policy.

A number of useful sites provide information to help you protect yourself such as;

• The MakeItSecure website set up by the Department of Communications to help educate people about the online risks.
• The Internet Crime Complaint Center's (IC3) has a tips page providing a list of recommendations.

• Advise given by eBay to protect users of their site.

• The Webtrust website provides a number of online consumer tips.

The SANS Institute Updates its Top 20 Vulnerabilities
The latest update to the SANS Institute's Top 20 Vulnerabilities shows a number of trends.  The most interesting amongst these is the increase in vulnerabilities being discovered in the Apple MAC OS/X operating system and the more targeted type of Phishing attacks, known as Spear Phishing.  Spear Phishing attacks are where an attacker sends e-mail pretending to be a trusted source, such as the company's network administrator, to a targeted victim who turns over sensitive information to the attacker.

Guidelines on How to Manage Security Logs.
Security logs are one of the most important yet overlooked tools available in protecting your network.  The US National Institute of Standards and Technology released a draft version of their technical guidelines on how to manage security logs. The guidelines cover log generation, transmission, storage, analysis and disposal.  Effective use of your security logs can provide you with hard evidence when trying to identify what occurred during an incident and help you address the "5 Ws" of incident investigation, Who, What, Why, Where and When.  For more information on managing your security logs you can also check out BH Consulting's white paper titled "Best Practises for Log Management".

Terrorists Hack Craft Website
This story from the Boston Globe is interesting in that it illustrates that no matter how small your company is, it can still be the target for malicious users.  On this occasion a website belonging to a small company selling glass crafts via their website was hacked by terrorists supporting Al Qaeda and used to distribute their writings.  It illustrates that no matter how small your company's web presence is, you cannot rely on the anonymity of the Internet to protect you or think that you are too small for anyone to care or want to hack you nor feel "it will never happen to me". 

Calculating the Cost of A Security Breach
This tool can be used to help you estimate the costs of a privacy breach, i.e. where personal data for clients could be exposed.  While the tool is focused primarily for the US market and is used to promote the company's products, it might be of some use to help determine the potential € impact of a breach. This could help you provide some objective rather than subjective data for your risk assessments or justification for purchasing of a solution.

Also on our website you will find a new page outline our Security Assessment Service which provides an independent review of your information security.

Tools for Monitoring Network Activity
PortQry and PortReporter are 2 tools that can help you determine which programs are listening on your computer\'s network ports. Such tools are important if you need to troubleshoot network services or detect unwanted programs. PortQry is a... Click Here for more info

Forensics: Collecting the Evidence Before You Lose It
When faced with a compromised system your first inclination may be to immediately pull the power plug. However there is a good deal of valuable information to be gleaned from the live system that will be lost when you turn it off. Based on the... Click Here for more info

Protecting Yourself Against Social Engineering
You've probably heard the age-old axiom, "A chain is only as strong as its weakest link." And if you've been around IT security for any length of time, you probably know that most often the weakest link turns out to be us-the organics-the human... Click Here for more info