Insider Threat Most Costly for Organisations

This article was originally posted by 'The New New Internet - The Cyber Frontier' and can be found here. There is also a powerpoint presentation summary of the survey results.

A new cybersecurity survey found that cyber attacks perpetrated by so-called “insiders” — those with inside knowledge or authorised access — are viewed as the most costly and damaging to an organization. 

The 2011 CyberSecurity Watch Survey conducted by CSO magazine and sponsored by Deloitte found that 33 percent viewed inside attacks as more costly, an increase of 8 percent over last year. The survey reports that while more attacks are caused by outsiders (58 percent), the insider threat is becoming increasingly sophisticated.

The use of rootkits and other hacker tools by insiders jumped from 9 percent last year to 22 percent this year.

Aside from the monetary losses, the insider threat could tar an organization’s reputation, disclose confidential or proprietary information or disrupt critical systems — all of which can be “difficult to quantify and recoup,” the survey finds.

And, even with insider threats likely only to grow, the public is often left in the dark. That’s because about 70 percent of insider attacks are handled by the organizations with no official legal action taken.

“Technical defenses against external attacks and leakage of well-formatted data like social security numbers and credit card numbers have become much more effective in recent years,” said Dawn Cappelli, technical manager of the Insider Threat Center at CERT, the federal agency tasked with monitoring cyber threats. “It is a much more challenging problem to defend against insiders stealing classified information or trade secrets to which they have authorised access or against technically sophisticated users who want to disrupt operations.”

The report also found that, overall, cyber attacks are on the rise. Twenty-eight percent of respondents said have seen an increase in the number of events, according to the study.

But, while attacks are increasing, they are not as financially damaging as in previous years, likely because of strategic and proactive steps that organisations are taking.

2012 Tickets Ballot Opens - Fraud Warning

The 2012 ticket ballot opens today, 15th March 2011. The below information relates to the fraud prevention advice that has been agreed for anyone thinking of purchasing Olympic tickets.

The advice is very simple, do not use unauthorised websites. It is very important to get this message out to everyone wishing to purchase tickets. As a lot of our blog visitors are from overseas we thought we’d post this information as it is widely agreed in fraud prevention circles that by attempting to take away the market place from the scammers it reduces to opportunity for exploitation and fraud.

The Metropolitan Police's Operation Podium urges you to follow this advice to protect you, your personal details, family and friends from being exploited by criminals.

If you’re buying a ticket for the Games:

• The 2012 ticket ballot opens today (15th March 2011). You have until 26 April to apply for tickets through LOCOG as it is not first come first served
• Only apply for a ticket online at www.tickets.london2012.com. This is London 2012’s official site. You can get a paper application from any Lloyds TSB branch, or from any public library in Northern Ireland
• If you get a ticket for an event you can’t attend, you can return your ticket to get a refund through the London 2012 official ticket exchange. Your ticket will then be officially resold
• Don’t buy a ticket from an unauthorised website or tout. You risk being scammed, and not getting the ticket you wanted and paid for
• There are only three official providers for Games Breaks and Hospitality Packages in the UK - these are:

• Thomas Cook - http://www.thomascooklondon2012.com
• Prestige Travel - http://www.prestigeticketing.london2012.com/
• Jet Set Travel - http://www.jetsetsports.com/
• Other websites or companies will not be authorised to sell you a ticket
  as part of a package.

Always check the terms and conditions to see exactly what you are being sold; If you find tickets for sale before the 15th March 2011 or available from any unauthorised source at anytime, don’t buy them. They are not genuine. Report it to http://www.actionfraud.org.uk/ or London 2012 via brandprotection@london2012.com or your local police force.

Good Luck and safe buying.

19,000 scam emails in four days

More than 19,000 scam emails have poured into the National Fraud Intelligence Bureau (NFIB) since Action Fraud set up a dedicated email address for people targeted online by fraudsters.

For years, criminals have been sending letters telling recipients they have won the lottery, are in line for a massive inheritance or have won a competition, and that to claim the prize they only need pay an administration fee.

Today the objective remains the same, but electronic mail is now the favoured vehicle to distribute the tens of thousands of scam emails that seek to persuade people to pay an advanced fee for a sum of money they will never see.

Read about how you can forward on your scam emails to Action Fraud.

News - The Threat Within

This is an excellent example of the threat an insider can pose to an organisation (and in this case potentially the public). Rajib KARIM deliberately sought a job in the UK that he could exploit for terrorist purposes.

KARIM was convicted on four counts of engaging in conduct in preparation of acts of terrorism, contrary to section 5 of the Terrorism Act, following a trial at Woolwich Crown Court.

For more information on the case visit The Met Police website.

 Security, security assurance, counter terrorism, personnel security,  Security, security assurance, counter terrorism, personnel security,  Security, security assurance, counter terrorism, personnel security,  Security, security assurance, counter terrorism, personnel security,  Security, security assurance, counter terrorism, personnel security,