The stories you want. The opinions that matter.
No, thanks
Tag: computers
Cyberattacks On State Databases Escalate

Cyberattacks On State Databases Escalate

NASHVILLE, Tenn. — State governments are facing a daily barrage of cyberattacks from increasingly sophisticated computer hackers. The hackers’ rapidly changing tactics threaten the exposure of personal information of millions of people and can cost millions of dollars to fix.
“We see attacks on Texas’ system to the tune of millions a month,” said Karen Robinson, Texas’ state chief information officer.
Although breaches of Texas state computers are rare, Robinson said, the risks are high. They can result in the theft of Social Security numbers, dates of birth, driver’s license numbers and even personal and business financial information.
All states face a growing number of wide-ranging, quickly evolving attacks, according to a report from the National Association of State Chief Information Officers and the consulting firm Deloitte & Touche.
Despite the threat, the report found, state legislators often don’t give their technology and security officials enough money to fight it, and states struggle to retain technologically savvy cybersecurity personnel.
The report said the dangers of insufficient cybersecurity are high, not only for people citizens whose personal information can be compromised, but also for taxpayers and the public’s trust in government.
“These incidents have cost states millions of dollars in clean-up costs, as well as a loss of both revenues and public trust,” the report said. “The problem is not likely to go away any time soon, as cybercriminals continue to be drawn to the wealth of data residing in each state.”
State computers hold a treasure trove of personal information. Motor vehicle agencies have dates of birth and driver’s license numbers. Health agencies have people’s birth certificates and Social Security numbers. Tax records show what banks people and businesses have accounts with. States also have credit card numbers from people who have made payments to state agencies.
“You can get pretty much everything on someone out of state computers,” said Srini Subramanian, a state cybersecurity specialist with Deloitte who co-authored the report. “It makes them a very attractive target to cybercriminals.”

Recent breaches point up the dangers and the costs:
Montana notified 1.3 million people in June that their personal data was possibly exposed to hackers in a breach of state Department of Public Health and Human Services computers a year earlier. The state said there was no evidence that personal information was stolen, but offered free credit monitoring and insurance for a year to those they notified.

Washington state’s court system was hacked in February, exposing up to 160,000 Social Security numbers and a million driver’s license numbers. The courts’ administration office said some numbers in its computers had definitely been accessed.

California’s Department of Technology reported 7,345 data breaches at state departments and agencies from the beginning of 2013 through early November last year, KNTV television reported. The state had to notify 23,379 people that their personal information may have been compromised, and spent at least $5 million to fix the breaches.
Although not every state database has been badly breached, the threat is a daily one. Six out of 10 of the state chief information and security officers from 49 states pointed to greater sophistication in the attacks, the report said. That’s an increase from two years ago, when a similar report found that roughly half saw more sophisticated tactics.

“Everybody is getting hit daily,” said Michael Cockrill, chief information officer for Washington state.
Cockrill, who recently came to his new job from the private sector, said he’s seen reports that as many as 40 percent of cyberattacks launched in the U.S. originate from inside his state.
Thieves want the personal information stored by states because it helps enable identity theft that opens greater doors of financial opportunity, the information officers said. That’s more valuable than just credit card information, which can be damaging enough.
“Health records are valuable because they have so much information,” Cockrill said of the dates of birth and Social Security numbers they can contain. “Health records are worth $10 on the black market, credit cards a dollar.”

Although the report’s survey said the security officials’ biggest fear is the placement of malicious software code in state computers, other threats are on the rise that can compromise personal information.
Eight out 10 of the officers predict an increase in “phishing” and “pharming” for personal or business information, and 72 percent predict more “social engineering” of people — manipulating them into divulging personal information or tricking them into schemes to defraud them.
Phishing attacks usually involve fraudulent email messages that guide victims to fake websites that look legitimate, but which are designed to obtain personal information such as passwords to their financial accounts.
Pharming redirects people from legitimate websites that have been tampered with to other sites that are fake.
Also on the rise is “hacktivism,” the hacking into government computers to make social statements, cause mayhem or provide platforms for activist groups to gain exposure.

“They aren’t after financial gains,” Deloitte’s Subramanian said. “They want to make a statement. And what’s a better place to make a statement than on a state government site.”
One example, he said, is Ferguson, Mo., where police computers and those of police unions were attacked by activists seeking the identity of the officer involved in the racially charged shooting this summer that set off nights of civil unrest.
Only 24.5 percent of the information and security officers said they were “very confident” they could protect against cyberthreats, the report found. That’s little different from two years ago, when 24 percent said the same thing.
In contrast, 60 percent of officials in the state departments and agencies that the information technology officers serve say they are very confident in their states’ abilities to protect them.
That disconnection between the information technology people on the front lines and other state officials helps explain why states aren’t putting as much money into cybersecurity as they should, Subramanian said.

About half the states allocate only 1 percent to 2 percent of their information technology budgets to security, the report said. The federal government, by contrast, allocates about 11 percent, Cockrill said.
States rely in large part on outside security software companies to help protect and police their computer systems. And despite their increased sophistication in surveillance, protection and response, most state officers said they are only somewhat confident in their cybersecurity.
States also have trouble getting and hanging onto trained cybersecurity personnel.
Fifty-nine percent of the officers surveyed for the report said they are short on trained people. That’s up from the 46 percent who said so two years ago.
The officers say states simply cannot pay as much as the private sector. That’s especially true in high-tech Washington state.
“We’ve been hiring people from Eastern Europe to provide security,” Cockrill said. “We’re a training ground for the private sector. They come, they get trained and get paid twice as much or more in the private sector.”

To recruit new security analysts, Cockrill is turning to military veterans. With some grant money, he’s seeking to give them computer skills to supplement the security and threat analysis experience they have from their military service. To retain them, he said, he’ll have to appeal to their sense of duty, because he can’t pay salaries nearly as high as what is available in the private sector.

AFP Photo/Greg Wood

Want more national news and analysis? Sign up for our daily email newsletter!

Stopping Cyberattacks Likened To A War And Experts Say The Crooks Are Winning So Far

Stopping Cyberattacks Likened To A War And Experts Say The Crooks Are Winning So Far

By Steve Johnson, San Jose Mercury News

SAN JOSE, Calif. — After last week’s stunning revelation that Russian crooks had stolen 1.2 billion user names and passwords, the biggest breach on record, experts say making the Internet more secure will take a huge global effort — bolstering website security, a stronger push to prosecute the cybercriminals, and better vigilance by consumers.

How much all that might cost is unclear, with some experts estimating it could take billions of dollars, while others insist it’s more a matter of redirecting what already is being spent toward more fruitful areas. But even then, critical information on the Internet may never be entirely safe, given the growing sophistication and ability of hackers to find new ways to steal it.

The attack by a Russian gang, uncovered by a Milwaukee security firm, has inflamed concerns about data protection on the Internet and whether the security practices of thousands of companies around the world are sufficient to protect financial and personal information. Security experts say businesses need to take the lead in countering the threat, particularly since the software and gadgets they make to access the Internet are frequently riddled with weaknesses that hackers can exploit.

“There is zero or very little corporate responsibility being taken to insure products in the market are safe,” said Melissa Hathaway, a former top federal cybersecurity official with the National Security Council and the Office of the Director of National Intelligence, who now has a consulting firm. “If we continue to see the market the way it is, we’ll see more victims.”

Critics have faulted many companies for being slow to address their vulnerabilities because of factors including ignorance about the extent of their flaws and the cost associated with fixing them.

Alan Paller, director of research at SANS Institute, an organization that trains computer-security experts, said that because software can be easily manipulated by crooks, it’s essential to either make programmers responsible for the financial damage that results when their code is hacked, or, at least, make them demonstrate they know how to write safe software through a skills test.

Paller said companies also need to improve the ability of their security staffs to deal with cybercriminals who sneak into the corporate networks. I don’t think they know how to do it in many cases,” he said.

Moreover, he said companies should stop wasting money writing security-related reports — some of which are required by the federal government — and focus more on actually battling hackers.

That’s why he believes tackling cyber crime wouldn’t require a huge additional expenditure, because “fundamentally, it’s a shift from talking about the problem to fixing the problem.”

But others argue that companies will need to spend substantially more, because many of them so far haven’t taken the threat seriously.

One key measure companies could take is to shift from having their websites accessed with user names and passwords to employing biometric identification systems, according to Larry Ponemon, whose Ponemon Institute studies data protection and privacy issues. He noted that some companies already offer voice identification technology for accessing computer gadgets, and he predicts that retinal and facial identification devices could become widely available within five years.

Others argue that the best way companies can avoid having their websites or other operations breached is to think more like the hackers, pointing to Tuesday’s disclosure about the 1.2 billion user names and passwords that were stolen from 420,000 websites.

“This breach illustrates how traditional security tools alone don’t do enough,” said Carl Wright of TrapX Security of San Mateo, adding that businesses “must be as nimble as the attackers themselves and be able to adapt in real-time to defend against evolving threats.”

Several experts also implored the government to work more with foreign nations to crack down on cybergangs, and increase penalties for U.S. companies that lose personal information due to security lapses. And until better methods are instituted, consumers are advised to stop using the same passwords or other personal identifiers to access different websites, because that practice greatly increases their chances of having their identities hijacked and their bank accounts, credit card numbers, or other data stolen.

Even with a concerted effort by everyone, experts say, it’s going to be tough to stem the growing tide of cyberattacks.

“It seems to be getting worse and if we look at this as warfare we are losing most of the battles,” said Ponemon, noting that “the cyberattackers are stealthy and smart and well funded.” But over the next decade, “we stand a good chance to win the war. I’m mildly optimistic.”

AFP Photo/Jim Watson

Interested in national news? Sign up for our daily email newsletter!

Microsoft To Cut 18,000 Jobs In Major Reorganization

Microsoft To Cut 18,000 Jobs In Major Reorganization

New York (AFP) — Microsoft’s new chief Thursday unveiled the biggest job cuts ever at the U.S. tech giant, aiming for a new strategic direction while integrating the Nokia phone division.

The company said it would slash 18,000 jobs from its global workforce over the next year, the majority from the Nokia unit acquired this year.

The cuts represent about 14 percent of Microsoft’s global payroll of some 127,000. The company will take a charge of between $1.1 billion and $1.6 billion for costs related to the layoffs.

Of the total, some 12,500 professional and factory positions from Nokia “will be eliminated through synergies and strategic alignment,” Microsoft said.

Chief executive Satya Nadella said in an email to employees that the “difficult but necessary” cuts are part of a plan to bring a new focus to the US tech giant.

“The first step to building the right organization for our ambitions is to realign our workforce,” he said.

“It’s important to note that while we are eliminating roles in some areas, we are adding roles in certain other strategic areas.”

Nadella added that “we are moving now to start reducing the first 13,000 positions, and the vast majority of employees whose jobs will be eliminated will be notified over the next six months.”

Microsoft completed its takeover of Nokia’s phone unit in April in a move that strengthened its position in mobile devices. The cost was around $7.5 billion.

The moves come with Nadella, who became CEO earlier this year, seeking to reinvigorate a company that had been the world’s largest but which has lagged in recent years as Google and Apple have taken leadership of the tech sector.

Nadella said the restructuring “will simplify the way we work to drive greater accountability, become more agile and move faster,” and would mean “fewer layers of management, both top down and sideways.”

– New smartphone push –

As part of the shift, Microsoft will make a new push on smartphones, where it has managed to win only a modest market share for its Windows Phone platform.

“We will be particularly focused on making the market for Windows Phone,” said an email to employees from Stephen Elop, the former Nokia chief who now heads the Microsoft Devices unit

“In the near term, we plan to drive Windows Phone volume by targeting the more affordable smartphone segments, which are the fastest growing segments of the market, with Lumia,” he said, referring to the Nokia-branded device.

Elop said that Microsoft will shift some of its Nokia X phones — which use the Google Android platform — to Windows Phone.

“We expect to make this shift immediately while continuing to sell and support existing Nokia X products,” he said.

Analyst Jack Gold at J. Gold Associates said the changes are “the first major salvo in the Nadella era” and appear positive.

“I believe that Nadella gets the fact that Microsoft can’t be Apple — a totally vertically integrated environment, and will refocus on cloud, services and software assets that are growing and profitable,” Gold said in an email.

“This is a similar path that Google took over the past few years as it too tried to be Apple for a while and realized it couldn’t.”

Windows Phone has managed to garner only about three percent of the global smartphone market, compared with around 80 percent for Android.

Elop said Microsoft will aim for “breakthrough products” in the premium smartphone segment while building up the Windows app ecosystem.

He said the phone engineering efforts will be led mainly from Finland, with reductions in China and the United States.

Phone production will be mostly in Vietnam, with some operations continuing in China, Elop said. Some manufacturing and repair operations will be shifted to Brazil and Mexico amid a “phased exit” from Hungary.

AFP Photo / Markku Ruottinen

Interested in national news? Sign up for our daily email newsletter!