USA Today: Hackers got into 18 computer servers at World Bank

Did you see the USA Today article on the World Bank intrusions?

Cyberintruders used the Internet to crack into at least 18 computer servers at the World Bank Group last July.

One bank memo lists the breached servers and makes this assessment: "As of 9/9/08 we have determined that 5 of the compromised servers contain sensitive data, and care must be taken to determine the amount of information that may have been transmitted outside of the World Bank Group."

Wow, sounds like old school system penetrations. And here we thought all the hacking nowadays was through browser and email exploits.

Banks, indeed, are not the only targets. Corporate intrusions in general are on the rise, says Phil Neray, vice president at database security firm Guardium. Cybercrooks seek out PCs used by privileged insiders so they can access sensitive databases and other PCs. "Many organizations don't have any real-time monitoring or alerting mechanisms in place to identify unauthorized activities," Neray says.

Hopefully the state of information security in private industry is a lot better these days but somehow I doubt it. The risk needs to be palpable enough for CEOs to give a crap. As for the realtime monitoring, that should really be the last line of defense. The detective control to catch whatever preventative controls don't.

To me this type of article underscores the need to look at security in breadth across the enterprise as well as in depth. It's like securing a house. You don't put an iron door on a tin shed. Hackers are looking for the one way in. So make all the ways in a little bit harder.

Targeting Oddball Platforms

Another article on targeted attacks. Larry Seltzer makes an interesting point towards the end of the article about the use of oddball operating systems and applications.

Some experts might recommend that you use alternative platforms like the Mac or OpenOffice, but these really don't help at all with targeted attacks. If someone's rolling out a new vulnerability for a targeted attack, it's just as easy for them to do it on OpenOffice and the Mac, which have numerous vulnerabilities, as for Windows. In fact, it's easier and cheaper for them to do it on the alternatives, where the price for a new, unpatched vulnerability is probably much cheaper than for Windows.

I'd think oddball platforms probably help with mass attacks. Those attacks are more likely to target Windows and more likely to be a bigger issue for home users. So, switching over to an alternative platform could make more sense for the home user; the cost/benefit analysis probably looks different than it would to an enterprise.

What makes the most sense, I think, is to make sure you continue patching regularly, and use security software like firewall, anti-spyware / anti-virus. When I say "firewall" I mean the kind that detects and blocks outbound network traffic on a per-process basis as well as inbound traffic.

Espionage and China

This article by the Washington Post makes an interesting read regarding the threat of economic espionage from China and Chinese nationals.

I wonder how much current concern about this topic is grounded in reality versus hysteria. It'd be worth finding out how many cases of corporate espionage involve countries other than China, and how many are perpetrated by U.S. citizens or by non-Chinese foreign nationals. Maybe it seems like there's an epidemic of Chinese espionage simply because those are the stories that sell best.