Threat Mitigation Strategies for Virus in Japan
|
|
|
- Dominick Parrish
- 5 years ago
- Views:
Transcription
1 Copyright 23 IPA/ISEC Threat Mitigation Strategies for Virus in Japan AVAR 23 November 7, 23 Yasuko Kanno IT Security Center IPA, Japan IPA Overview IPA Information-technology Promotion Agency, Japan Quasi-governmental organization : Ministry of Economy, Trade and Industry (METI), will be restructured into Independent Administrative Institution Established: October, 197 Mission: Information processing technology promotion Personnel: About 17 R&D and Support Advanced Software Technology IT Security Technology E-Commerce Technology E-Government Support Education & Training Develop Training Materials Educational Support Credit Guarantee IT Security Enhancement Copyright 23 IPA/ISEC Slide 2 IPA/ISEC Overview (ISEC: Information technology SEcurity Center) Mission : IT Security Enhancement in Japan Established in January, 1997 Had been working on anti-virus activities since October, 1991 Current Personnel : around 4 Including guest researchers, technical and administrative staffs 4 Groups Planning and Research Group Virus & Unauthorized Access Countermeasures Group Cryptography Research and Evaluation Group Security Evaluation & Certification and Information Assurance Group Copyright 23 IPA/ISEC Slide 3 Today s Agenda 1. Statistics out of IPA surveys and virus detection reports to IPA. 2. Current tendency of virus including fast spreading worms 3. Countermeasures to mitigate virus threat. Copyright 23 IPA/ISEC Slide 4 Data Source PART 1 The Present Virus Status in Japan Statistics out of IPA surveys and virus detection reports to IPA. 1. Virus Detection Report by or FAX submitted to IPA everyday 2. Annual Virus Survey by IPA 3. Recent Survey regarding Blaster Copyright 23 IPA/ISEC Slide 5 Copyright 23 IPA/ISEC Slide 6
2 Virus Detection Report Format of the report to IPA Copyright 23 IPA/ISEC Slide 7 Virus Detection Report - Sep 23 Monthly Press This is an example of monthly virus incident report for September 23 complied by IPA. IPA made monthly press release to show the virus incident tendency and advice the Best Current Practice to protect against virus. In September 1,794 reports were submitted and there is a little decrease of the number comparing August repots of 2,14 Copyright 23 IPA/ISEC Slide 8 Virus Detection Report - Sep 23 12% 3% 3% 4% What Virus? 29% Virus Detection Report - Sep %.1% 8.3% From Where? 9.5% 4% 8% 15% 1% 12% N=1794 W32/Sobig W32/Klez W32/Swen W32/Mimail W32/Bugbear W32/Welchi W32/Fizzer W32/MSBlaster VBS/Redlof Others Media Download Unknown N=1794 Copyright 23 IPA/ISEC Slide 9 Copyright 23 IPA/ISEC Slide 1 Virus Detection Report - Sep 23 How many PCs are infected? 1.% 4.3% 2.5% 92.2% N=1794 Not infected 1PC 2-4PCs More than 5 PCs Copyright 23 IPA/ISEC Slide 11 Virus Detection Report Apr 22-Sep 23 Nu mb e r Report Source 18. 5% 11. 2% 5. 3% 15. 3% 12. 4% 5. 7% 6. 9% 9. 9% 9. 5% 7. 9% 8. 2% 5. 7% 76. 2% 74. 8% 78. 1% 83. 9% 88. 5% 81. 8% Corporate Education Individual Copyright 23 IPA/ISEC Slide 12
3 Virus Detection Report Apr 22-Sep 23 Virus Detection Report Apr 22-Sep 23 Nu mb e r Change in number of reports by quarter 6, 387 4, 73 4, 53 3, 969 3, 397 5, 219 Number 1 1 Shift of Viruses in Monthly Reports W32/Sobig W32/Klez W 32/Bugbear 1 7% 6. 5% 9. 1% 5. 9% 4. 6% 11. 9% W 32/Fizzer 1 W32/MSBlaster W 32/Badtrans shows the number of damaged bodies shows the number of detected cases before infection Copyright 23 IPA/ISEC Slide 13 1 W 32/Frethe 2/4 2/7 2/1 3/1 3/4 3/7 2/6 2/9 2/12 3/3 3/6 3/9 Copyright 23 IPA/ISEC Slide 14 Prevalence Table - Aug. 23 VB IPA 1. Win32/Sobig 66.29% Win32/Sobig 26.91% 2. Win32/Miami 18.74% W32/Klez 2.31% 3. Win32/Opaserv 5.54% W32/MSBlaster 15.64% 4. Win32/Bugbear 2.3% W32/Bugbear 7.6% 5. Win32/Klez 1.61% W32/Miami 5.31% 6. Win32/Nachi 1.28% W32/Welch 4.27% 7. Win32/Dupator 1.1% W32/Fizzer 3.77% 8. Win32/Yaha.68% VBS/Redolf 3.13% 9. Win32/Lovsan.51% W32/Yaha 2.33% 1. Win32/Funlove.37% Wscript/Fortnight 1.54% : Win32/Lovsan is also known as W32/MSBlaster Win32/Nachi is also known as W32/Welch Copyright 23 IPA/ISEC Slide 15 Annual Virus Survey Questionnaires 5, questionnaires sent to various companies/organizations in Japan - done every year since returned 1,812 responses (36%) - term: Jan. Dec. 22 Copyright 23 IPA/ISEC Slide 16 Annual Virus Survey 22 Response by organisation size 13% 7% 9% 34% 19% 18% N=1812 corporations/organizations Copyright 23 IPA/ISEC Slide 17 Annual Virus Survey 22 Virus Encounter Rate % Copyright 23 IPA/ISEC Slide 18
4 Annual Virus Survey 22 Encounter Rates by number of employees % 1 Number of Employees and more 22 Copyright 23 IPA/ISEC Slide 19 Change of infected rate Was your computer already infected or did you find it before infection? Number , , ,19 24, ,352 1,791.% 2.% 4.% 6.% 8.% 1.% Detection only Infection Copyright 23 IPA/ISEC Slide 2 Annual Virus Survey 22 Frequency of applying Security Patch Annual Virus Survey 22 Anti-virus software Update Management Always the latest patch is applied Sometimes Applied Unknown Periodically Applied Quite rare or Not Applied Copyright 23 IPA/ISEC Slide 21 Copyright 23 IPA/ISEC Slide 22 Annual Virus Survey 22- Overseas Survey-for U.S.A., Germany, Korea and Taiwan Respondents ratio classified by number of employee Country U.S.A Germany Korea Taiwan Number of employee N=52 (%) N=52 (%) N=5 (%) N=51 (%) No Answer.... Annual Virus Survey 22- Overseas Rate of Infection/Detection % 2% 4% 6% 8% 1% U.S.A Germany Kore a Taiwan Infection De t e c t i on Onl y No Encount er No Response The survey was conducted by visiting companies and got 5 and more of responses for each country. Copyright 23 IPA/ISEC Slide 23 Copyright 23 IPA/ISEC Slide 24
5 Annual Virus Survey 22- Overseas Anti-virus software Update Management % 2% 4% 6% 8% 1% U.S.A Recent Survey regarding Blaster and Welch Germany Korea Taiwan Manage d Not Managed Unknown No Response Questionnaire through telephone and fax - from 28 Aug, Sep, 3 (2weeks) - to corporate user (mainly system administrator) - returned 982 responses Copyright 23 IPA/ISEC Slide 25 Copyright 23 IPA/ISEC Slide 26 Infected body (percentage) by MSBlaster and Welchi em ployee 1-29n=18 em ployee 3-99n=223 em ployee more than 1 n=462 % 1% 2% 3% 4% 5% 6% 7% 8% 9% 1% 11.1% 14.8% 23.4% 85.% 81.6% 74.9% 3.9% 3.6% 1.7% Infected Date by MSBlaster and Welchi MSBlaster Welchi Total n= % 78.7% Infected Not infected Unknown 2.7% / /1 2Unknown Copyright 23 IPA/ISEC Slide 27 ( n=164 ) Copyright 23 IPA/ISEC Slide 28 How many days to recover from the damage about2-4 days 6.6% more than 1 days about % days 7.6% Ban to use PCs.6% about1 hour 22.3% ( n=157 ) What kinds of taking measures ( n=866 ) % 1% 2% 3% 4% 5% Windows Update 47.% Alarm the user 39.% InstallAnti-Virus Software 1.2% Change param eter offirewall/router 9.2% aboutone day 26.1% abouta half day 23.6% No specific m easures 3.8% Copyright 23 IPA/ISEC Slide 29 Copyright 23 IPA/ISEC Slide 3
6 Shift in Numbers of Monthly reports Num ber 45 Shift in Numbers of Monthly Reports PART 2 Current tendency of virus including fast spreading worms Copyright 23 IPA/ISEC Slide ,261 reports ,352 reports 23 (up to sep) 12,585 reports Note: the num ber ofthe reports in each year of 9 (4-12), '91, '92, '93, '94, '95, '96, '97, '98, '99, ', are 14, 57, 253, 897, 1127, 668, 755, 2391,235, ,19 (IPA/ISEC) Copyright 23 IPA/ISEC Slide 32 Tendency of Virus from Change of the Method of Infection Number of Reports Rage of Viruses that abuse Security Hole (Klez). Appearance of Virus that use Japanese Subject (Fbound) 24,261 Rage of Viruses that abuse systems (Hybris, MTX, Sircam). Appearance of Viruses that abuse Security holes (Nimda, Aliz, Badtrans) 2, Sharp increase of Viruses that abuse systems (LOVELETTER, MTX, Navidad) Appearance of Virus that abuse systems (Ska) Widespread of Macro Viruses 897 1, ,391 2,3 5 3,645 11,19 1,791 Year (*23 Jan-Aug) Copyright 23 IPA/ISEC Slide 33 External Medium Download file Unknown Copyright 23 IPA/ISEC Slide 34 Types of Viruses Major Viruses reported from Jan Aug, number 2,35 3,645 Name of the Virus Number First reported Method of Infection & Security Hole & Security Hole , , , ,791 % 2% 4% 6% 8% 1% Abusing Security holes Abusing systems Macro Virus Others Copyright 23 IPA/ISEC Slide 35 & Security Hole Abuse Security Hole Macro Virus (Excel) Copyright 23 IPA/ISEC Slide 36
7 Outbreak of W32/MSBlaster First reported Aug 23 Abuse RPC Vulnerability of MS3-26 Worm Infection Process Infected PC 1 Attack the port Open the port 4444and wait Shut down Vulnerable PC Shut down 3 Send Worm (msblast.exe) Execute msblast.exe, PC was infected Infected PC Just connect to the internet, then infected! Copyright 23 IPA/ISEC Slide 37 Current tendency of Virus * Abuse system (execute attached file and infected) * Abuse and Security Holes (no execution necessary) Only preview mails and infected (Klez. Frethem) Only see the Web page and infected (Nimda) * Abuse Security Holes -> fast spreading worms (IIS: CodeRed SQL: Slammer RPC: MSBlaster) * Abuse Shared Folders (Nimda, Bugbear) * P2P file system (Fizzer) Use Multiple Infection Method Copyright 23 IPA/ISEC Slide 38 Current tendency of Virus Mass infection and long term influence * Spread Millions of PCs in a twinkle (MSBlaster Slammer) * Spoof sender, Delete anti-virus software (Klez, Bugbear) Attack Computer Network * Denial of Service Attack * Falsification of Web page * Back Door * Leakage of the information PART 3 Countermeasures to mitigate virus threat Using Cracking Method and Spread rapidly Copyright 23 IPA/ISEC Slide 39 Copyright 23 IPA/ISEC Slide 4 Advise on Computer Virus IPA/ISEC provides advice on virus Around 2, advices per month via phone and fax 1: 17: Monday Friday emergency such as MSBlaster 24x7 Publishing FAQ on important advice via IPA/ISEC web site. Monthly Tips when press release September : Be careful about W32/Swen which deceive you in sophisticated way!! August : Historical Damage cased by W32/MSBlaster. Did you exterminated the worm? July: Invisible virus lurks in the mail. Did you installed the patch for the security hole? Copyright 23 IPA/ISEC Slide 41 Advise on Computer Virus Various information of countermeasures Best Current Practice for IT users in Japan The Seven Basic Anti-Virus Measures for PC Users The Five Instructions When Opening Attachment Files The Dangers of Downloading Various information of countermeasures New Virus Information Virus DB Anti-Virus School (CD-ROM) Anti-Virus Movie Check list of anti-virus countermeasures Investigation and report 5 millions web page accesses per month Copyright 23 IPA/ISEC Slide 42
8 Installation Rate of Anti-Virus Software for Clients Anti-virus software Update Management >=9% of PCs >=5% of PCs <5% of PCs No AV Software Source: Annual Virus Survey - 22 Copyright 23 IPA/ISEC Slide 43 Source: Annual Virus Survey - 22 Copyright 23 IPA/ISEC Slide 44 ALERTS IPA/ISEC provides alerts and information on countermeasures on specific web pages, when new viruses with fast spreading capability or serious vulnerability are found. Following alerts are issued recently W32/Swen (Listed on September 22, 23) Windows RPCSS (Listed on September 18, 23) W32/MSBlaster (Updated on September 11, 23) W32/Sobig (Updated on August 22, 23) Windows RPC vulnerability (Updated on August 13, 23) W32/Bugbear (Updated on June 9, 23) W32/Fizzer (Updated on May 14, 23) Copyright 23 IPA/ISEC Slide 45 IT Security Seminar From1995 held security seminar every autumn in cooperation with METI This autumn only in October more than 1 attendants in 8 locations Around 5 seminars in year More than 5 attendants per year Virus demonstration Distribute CD-ROM, Videos and Information Copyright 23 IPA/ISEC Slide 46 IPA Internet Observation System Internet traffic monitor using 8 global IP addresses (6 for monitoring, 2 for test) Mainly monitor ports scan (TCP/UDP) Real time logging Provide real time visual output Database function Make various reports from the accumulated data Internet traffic monitoring Sample Report - Top 2 port attacked * Top 2 port attack during 4 days form 23/6/29 * Accumulated data can be processed using Excel format Background Massive scanning activity, Random propagation of worms Flood of vulnerability information ( need information in the wild for appropriate risk analysis) Copyright 23 IPA/ISEC Slide 47 Copyright 23 IPA/ISEC Slide 48
9 IPA Countermeasures against W32/MSBlaster IPA Countermeasures against W32/MSBlaster On 17th July, Microsoft announced a new vulnerability IPA recognized the dangerous character and high risk level of this vulnerability and released emergency alert on our web page. Since the announcement of this vulnerability, IPA alerted to pay high attention against the appearance of the worm which exploits this vulnerability. Since then, IPA gathered as much as information from not only domestic but also international sources using IPA Multilingual Information System and also carefully watched internet traffic through IPA Internet Observation System. 12 th August IPA Activities * Consultation over the phone. * Distribute recovery manual by fax. * Emergency Level Support of 24 x 7 * Gather and provide information using IPA internet observation system. * Release alert to users who will return from their summer vacation. Call/Fax/Mail in this period new total 8/12 (Tue) 7 7 8/13 (Wed) /14 (Thu) 4 6 8/15 (Fri) /16 (Sat) /17 (Sun) /18 (Mon) /19 (Tue) /2 (Wed) /21 (Thu) /22 (Fri) 3 24 About 1 days from the worm outbreak, the number of inquiries and phone calls or fax to IPA seeking advice and consultation against the worm showed the tendency to calm down. Copyright 23 IPA/ISEC Slide 49 Copyright 23 IPA/ISEC Slide 5 Data from IPA Internet Observation System Anti-Virus Activities Receives reports on Computer Virus Summarize reports and publicizes statistics/countermeasures monthly basis Virus Survey annually and occasionally Virus Alert Vulnerability Information Provide Best Current Practice Tip IT Security Seminar Internet Monitoring Copyright 23 IPA/ISEC Slide 51 Copyright 23 IPA/ISEC Slide 52 IT Security Center(ISEC) Information-technology Promotion Agency (IPA) isec-info@ipa.go.jp Copyright 23 IPA/ISEC Slide 53
Reporting Status of Computer Virus - Details for February 2008
Reporting Status of Computer Virus - Details for I. Details for Unauthorized Computer Access Incident Report 1. Number of Unauthorized Computer Access Reported by Month Detection Number of Virus by Montrh
Reporting Status of Computer Virus - Details for April 2008
Reporting Status of Computer Virus - Details for I. Details for Unauthorized Computer Access Incident Report 1. Number of Unauthorized Computer Access Reported by Month Detection Number of Virus/ Month
Reporting Status of Vulnerability-related Information about Software Products and Websites - 3 rd Quarter of 2015 (July September) -
Reporting Status of Vulnerability- Information about Software Products and Websites - 3 rd Quarter of 215 (July September) - Information-technology Promotion Agency, Japan (IPA) and Japan Computer Emergency
Reporting Status of Vulnerability-related Information about Software Products and Websites - 1 st Quarter of 2012 (January March) -
Reporting Status of Vulnerability- Information about Software Products and Websites - 1 st Quarter of 212 (January March) - Information-technology Promotion Agency, Japan (IPA) and Japan Computer Emergency
Observation by the Internet Fixed-Point Monitoring System (TALOT2) for November 2011
Observation by the Internet Fixed-Point Monitoring System (TALOT2) for November 2011 Attachment 3 1. To General Internet Users According to the Internet Fixed-Point Monitoring System (TALOT2), 86,568 unwanted
Reporting Status of Computer Virus - Details for December 2009
Reporting Status of Computer Virus - Details for I. Details for of Virus 1. Detection Number of Virus by Month 2. of Virus by Month 1 3. of Virus/Year 2 4. Reported Virus in Attachment 1 The total reported
Detecting Lateral Movement in APTs ~Analysis Approach on Windows Event Logs~ June 17, 2016 Shingo ABE ICS security Response Group JPCERT/CC
Detecting Lateral Movement in APTs ~Analysis Approach on Windows Event Logs~ June 17, 2016 Shingo ABE ICS security Response Group JPCERT/CC Agenda Introduction to JPCERT/CC About system-wide intrusions
Reporting Status of Vulnerability-related Information about Software Products and Websites
Reporting Status of Vulnerability- Information about Software Products and Websites - 3 rd Quarter of 218 (July - September) - Information-technology Promotion Agency, Japan (IPA) and Japan Computer Emergency
Observation by Internet Fix-Point Monitoring System (TALOT2) for February 2011
Observation by Internet Fix-Point Monitoring System (TALOT2) for February 2011 1. To General Internet Users According to the Internet Fixed-Point Monitoring System (TALOT2), 143,494 unwanted (one-sided)
SYMANTEC ENTERPRISE SECURITY. Symantec Internet Security Threat Report September 2005 Power and Energy Industry Data Sheet
SYMANTEC ENTERPRISE SECURITY Symantec Internet Security Threat Report September 00 Power and Energy Industry Data Sheet An important note about these statistics The statistics discussed in this document
Computer Virus/Unauthorized Computer Access Incident Report September 2008
Computer Virus/Unauthorized Computer Access Incident Report September 2008 This is the summary of computer virus/unauthorized computer access incident report for September 2008 compiled by IPA. I. Reminder
Observation by Internet Fix-Point Monitoring System (TALOT2) for March 2011
Observation by Internet Fix-Point Monitoring System (TALOT2) for March 2011 1. To General Internet Users According to the Internet Fixed-Point Monitoring System (TALOT2), 246,123 unwanted (one-sided) accesses
Report from the Internet Monitoring (TALOT2) July 2008
I. To the General Internet Users Report from the Internet Monitoring (TALOT2) July 2008 In the Internet Monitoring (TALOT2), unwanted (one-sided) access in July totaled 148,028 cases for the 10 monitoring
JPCERT/CC Internet Threat Monitoring Report [July 1, September 30, 2014]
![JPCERT/CC Internet Threat Monitoring Report [July 1, September 30, 2014]](/thumbs/85/91527925.jpg "JPCERT/CC Internet Threat Monitoring Report [July 1, September 30, 2014]")
JPCERT-IA-2014-03 Issued: 2014-10-28 JPCERT/CC Internet Threat Monitoring Report [July 1, 2014 - September 30, 2014] 1 Overview JPCERT/CC has placed multiple sensors across the Internet for monitoring
JPCERT/CC Incident Handling Report [October 1, 2015 December 31, 2015]
![JPCERT/CC Incident Handling Report [October 1, 2015 December 31, 2015]](/thumbs/83/87837079.jpg "JPCERT/CC Incident Handling Report [October 1, 2015 December 31, 2015]")
JPCERT-IR-2015-05 Issued: 2016-01-14 JPCERT/CC Incident Handling Report [October 1, 2015 December 31, 2015] 1. About the Incident Handling Report JPCERT Coordination Center (herein, JPCERT/CC) receives
JPCERT/CC Incident Handling Report [January 1, March 31, 2018]
![JPCERT/CC Incident Handling Report [January 1, March 31, 2018]](/thumbs/89/100577955.jpg "JPCERT/CC Incident Handling Report [January 1, March 31, 2018]")
JPCERT-IR-2018-01 Issued: 2018-04-12 JPCERT/CC Incident Handling Report [January 1, 2018 - March 31, 2018] 1. About the Incident Handling Report JPCERT Coordination Center (herein, JPCERT/CC) receives
Observation by Internet Fix-Point Monitoring System (TALOT2) for May 2011
Observation by Internet Fix-Point Monitoring System (TALOT2) for May 2011 1. To General Internet Users According to the Internet Fixed-Point Monitoring System (TALOT2), 189,497 unwanted (one-sided) accesses
Special Action Plan on Countermeasures to Cyber-terrorism of Critical Infrastructure (Provisional Translation)
Special Action Plan on Countermeasures to Cyber-terrorism of Critical Infrastructure (Provisional Translation) December 15, 2000 1. Goals of the Special Action Plan The goal of this action plan is to protect
Development of Information Security-Focused Incident Prevention Measures for Critical Information Infrastructure in Japan
Development of Information Security-Focused Incident Prevention Measures for Critical Information Infrastructure in Japan October 1, 2009 Hideaki Kobayashi *1, Kenji Watanabe *2, Takahito Watanabe *1,
JAPAN CYBER-SAVVINESS REPORT 2016 CYBERSECURITY: USER KNOWLEDGE, BEHAVIOUR AND ATTITUDES IN JAPAN
JAPAN CYBER-SAVVINESS REPORT 2016 CYBERSECURITY: USER KNOWLEDGE, BEHAVIOUR AND ATTITUDES IN JAPAN 1. Why did ESET undertake this survey? 2. Survey methodology 3. Key highlights 4. User confidence in protecting
Basic Concepts in Intrusion Detection
Technology Technical Information Services Security Engineering Roma, L Università Roma Tor Vergata, 23 Aprile 2007 Basic Concepts in Intrusion Detection JOVAN GOLIĆ Outline 2 Introduction Classification
Japan s Measures against Spam
June 22, 2, 2006 Japan s Measures against Spam Yoshichika Imaizumi Telecommunications Bureau, Ministry of Internal Affairs and Communications (MIC), Japan Characteristics of spam in Japan 1.. Media 2004
Internet Security Threat Report Volume XIII. Patrick Martin Senior Product Manager Symantec Security Response October, 2008
Internet Security Threat Report Volume XIII Patrick Martin Senior Product Manager Symantec Security Response October, 2008 Agenda 1 ISTR XIII Important Facts 2 ISTR XIII Key Messages 3 ISTR XIII Key Facts
Overview of nicter - R&D project against Cyber Attacks in Japan -
Overview of nicter - R&D project against Cyber Attacks in Japan - Daisuke INOUE Cybersecurity Laboratory Network Security Research Institute (NSRI) National Institute of Information and Communications
Protect Your Endpoint, Keep Your Business Safe. White Paper. Exosphere, Inc. getexosphere.com
Protect Your Endpoint, Keep Your Business Safe. White Paper Exosphere, Inc. getexosphere.com White Paper Today s Threat Landscape Cyber attacks today are increasingly sophisticated and widespread, rendering
NetDefend Firewall UTM Services
NetDefend Firewall UTM Services Unified Threat Management D-Link NetDefend UTM firewalls (DFL-260/860/1660/2560/2560G) integrate an Intrusion Prevention System (IPS), gateway AntiVirus (AV), and Web Content
Assessing Global Security Threat Levels Bryan Lu, Project Manager / Researcher
I AM NOT A NUMERO! Assessing Global Security Threat Levels Bryan Lu, Project Manager / Researcher 21-23 September 2009 Geneva, Switzerland Numero English: numero or number or No No. or # Spanish: número
Internet Threat Detection System Using Bayesian Estimation
Internet Threat Detection System Using Bayesian Estimation Masaki Ishiguro 1 Hironobu Suzuki 2 Ichiro Murase 1 Hiroyuki Ohno 3 Abstract. We present an Internet security threat detection system 4 using
Office of Inspector General Office of Professional Practice Services
Office of Inspector General Office of Professional Practice Services Executive Summary In accordance with the Department of Education s fiscal year 2017-18 audit plan, the Office of Inspector General (OIG)
Phishing Activity Trends Report March, 2005
Phishing Activity Trends Report March, 2005 Phishing is a form of online identity theft that uses spoofed emails designed to lure recipients to fraudulent websites which attempt to trick them into divulging
CSIRT in general CSIRT Service Categories Reactive Services Proactive services Security Quality Management Services CSIRT. Brmlab, hackerspace Prague
Brmlab, hackerspace Prague Lightning talks, November 2016 in general in general WTF is an? in general WTF is an? Computer Security in general WTF is an? Computer Security Incident Response in general WTF
The big questions: WildList Organization. How to answer our questions? ICSA Labs Surveys. Back to our questions. Virus Longevity Virus Lifecycle
Virus Longevity Virus Lifecycle Larry Bridwell Content Security Programs Manager ICSA Labs, a division of TruSecure Corp and Jaime Lyndon A. Yaneza Global Anti-Virus Research Group TrendLabs, Trend Micro
The Information Security Management Benchmark (abbr: ISM-Benchmark)
The Information Security Management Benchmark (abbr: ISM-Benchmark) July 17, 2008 Yasuko Kanno Chief Advisor, IPA Security Center Information-technology Promotion Agency, Japan (IPA) http://www.ipa.go.jp/security/
Japanese CC Evaluation & Certification Activity Update
Japan Information Technology Security Evaluation and Certification Scheme Japanese CC Evaluation & Certification Activity Update September 23, 2009 Hidehiro YAJIMA Managing Director, IT Security Center
The Information Security Guideline for SMEs in Korea
The Information Security Guideline for SMEs in Korea Ho-Seong Kim Mi-Hyun Ahn Gang Shin Lee Jae-il Lee Abstract To address current difficulties of SMEs that are reluctant to invest in information security
Prolexic Attack Report Q4 2011
Prolexic Attack Report Q4 2011 Prolexic believes the nature of DDoS attacks are changing: they are becoming more concentrated and damaging. Packet-per-second volume is increasing dramatically, while attack
Computer Security Trend 2008 from Japan. SQL Injection, DNS cache poisoning, Phishing, Key logger Malware and Targeted Attacks
Computer Security Trend 2008 from Japan SQL Injection, DNS cache poisoning, Phishing, Key logger Malware and Targeted Attacks JPCERT Coordination Center, Japan Manager of Watch and Warning Group Keisuke
AIMMS Function Reference - Date Time Related Identifiers
AIMMS Function Reference - Date Time Related Identifiers This file contains only one chapter of the book. For a free download of the complete book in pdf format, please visit www.aimms.com Aimms 3.13 Date-Time
Security Solutions Assisting Social Infrastructure Digitalization
FEATURED ARTICLES Social Infrastructure and its Digitalization Overview Solutions Assisting Social Infrastructure Digitalization Takeshi Miyao Junichi Tanimoto 1. Digitalization and Threats The rise of
Phishing Activity Trends Report November, 2004
Phishing Activity Trends Report November, 2004 Phishing is a form of online identity theft that uses spoofed emails designed to lure recipients to fraudulent websites which attempt to trick them into divulging
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Malware Outbreak
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
Effective Cyber Incident Response in Insurance Companies
August 2017 Effective Cyber Incident Response in Insurance Companies An article by Raj K. Chaudhary, CRISC, CGEIT; Troy M. La Huis; and Lucas J. Morris, CISSP Audit / Tax / Advisory / Risk / Performance
Ⅰ Introduction 1. Ⅱ Information Security Infrastructure and Environment 2. Ⅲ Information Security Incident Prevention 8
Ⅰ Introduction 1 Ⅱ Information Security Infrastructure and Environment 2 1. Information Security Policy 2 A. Information (Personal Information) Security Policy 2 B. Information Security Policy 3 C. Personal
HISPOL The United States House of Representatives Internet/ Intranet Security Policy. CATEGORY: Telecommunications Security
HISPOL 003.0 The United States House of Representatives Internet/ Intranet Security Policy CATEGORY: Telecommunications Security ISSUE DATE: February 4, 1998 REVISION DATE: August 23, 2000 The United States
About Issues in Building the National Strategy for Cybersecurity in Vietnam
Vietnam Computer Emergency Response Team - VNCERT About Issues in Building the National Strategy for Cybersecurity in Vietnam Vu Quoc Khanh Director General Outline Internet abundance Security situation
Project Platform Coordinator for Japanese SMEs
Project Platform Coordinator for Japanese SMEs March 30, 2018 Masayoshi Watanabe JETRO Düsseldorf Director General Under the policy of the Ministry of Economy, Trade and Industry (METI) / Small and Medium
Forensics and Active Protection
Forensics and Active Protection Computer and Network Forensics Research Project 2003 Work Update Yanet Manzano Florida State University manzano@cs.fsu.edu manzano@cs.fsu.edu 1 Outline CNF Project Goal
Korea Phishing Activity Trends Report
Korea Phishing Activity Trends Report June, 2006 Issued by KrCERT/CC, Korea Internet Security Center Korea Phishing Activity Trends Report analyzes phishing attacks reported to KrCERT/CC via the organization
The Republic of Korea. economic and social benefits. However, on account of its open, anonymous and borderless
The Republic of Korea Executive Summary Today, cyberspace is a new horizon with endless possibilities, offering unprecedented economic and social benefits. However, on account of its open, anonymous and
JPCERT/CC Internet Threat Monitoring Report [July 1, September 30, 2016]
![JPCERT/CC Internet Threat Monitoring Report [July 1, September 30, 2016]](/thumbs/90/104442060.jpg "JPCERT/CC Internet Threat Monitoring Report [July 1, September 30, 2016]")
JPCERT-IA-2016-03 Issued: 2016-11-16 JPCERT/CC Internet Threat Monitoring Report [July 1, 2016 - September 30, 2016] 1 Overview JPCERT/CC has placed multiple sensors across the Internet for monitoring
Phishing Activity Trends Report October, 2004
Phishing Activity Trends Report October, 2004 Phishing is a form of online identity theft that uses spoofed emails designed to lure recipients to fraudulent websites which attempt to trick them into divulging
NIC- Computer Emergency Response Team (CERT) Information Security Incident Management Policy
NIC- Computer Emergency Response Team (CERT) Information Security Incident Management Policy Document Control Document Title Information Security Incident Management Policy Document Type Policy Draft Document
CIMA Certificate BA Interactive Timetable
CIMA Certificate BA Interactive Timetable 2018 Nottingham & Leicester Version 3.2 Information last updated 09/03/18 Please note: Information and dates in this timetable are subject to change. Introduction
Information Security and Cyber Security
Information Security and Cyber Security Policy NEC recognizes that it is our duty to protect the information assets entrusted to us by our customers and business partners as well as our own information
CIRT: Requirements and implementation
CIRT: Requirements and implementation By : Muataz Elsadig Sudan CERT Joint ITU-ATU Workshop on Cyber-security Strategy in African Countries Khartoum, Republic of Sudan, 24 26 July 2016 There is no globally
Web Gateway Security Appliances for the Enterprise: Comparison of Malware Blocking Rates
Web Gateway Security Appliances for the Enterprise: Comparison of Malware Blocking Rates A test commissioned by McAfee, Inc. and performed by AV-Test GmbH Date of the report: December 7 th, 2010 (last
Data Communication. Chapter # 5: Networking Threats. By: William Stalling
Data Communication Chapter # 5: By: Networking Threats William Stalling Risk of Network Intrusion Whether wired or wireless, computer networks are quickly becoming essential to everyday activities. Individuals
Endpoint Protection : Last line of defense?
Endpoint Protection : Last line of defense? First TC Noumea, New Caledonia 10 Sept 2018 Independent Information Security Advisor OVERVIEW UNDERSTANDING ENDPOINT SECURITY AND THE BIG PICTURE Rapid development
Malware Research at SMU. Tom Chen SMU
Malware Research at SMU Tom Chen SMU tchen@engr.smu.edu www.engr.smu.edu/~tchen Outline About SMU and Me Virus Research Lab Early Worm Detection Epidemic Modeling New Research Interests TC/BT/11-5-04 SMU
Introduction. Controlling Information Systems. Threats to Computerised Information System. Why System are Vulnerable?
Introduction Controlling Information Systems When computer systems fail to work as required, firms that depend heavily on them experience a serious loss of business function. M7011 Peter Lo 2005 1 M7011
Symantec Endpoint Protection Integration Component User's Guide. Version 7.0
Symantec Endpoint Protection Integration Component User's Guide Version 7.0 The software described in this book is furnished under a license agreement and may be used only in accordance with the terms
Information Security Policies in Japan
Information Security Policies in Japan Towards a safe and secure network infrastructure Fumiaki TAKAHASHI Director, ICT Security Office, Information and Communications Policy Bureau, Ministry of Internal
IT Services Executive Summary May 2017 1631 Incidents KPI As expected, the trend for a majority (1631) (4365) Incidents 78% Volumes Requests Requests 94% (4) (158) P1 Inc. 50% 4365 P2 Inc. 88% 2211 Phone
The 2017 State of Endpoint Security Risk
The 2017 State of Endpoint Security Risk Attacks are evolving. As a result, today s organizations are struggling to secure their endpoints, and paying a steep cost for each successful attack. To discover
Real Security. In Real Time. White Paper. Preemptive Malware Protection through Outbreak Detection
Real Security. In Real Time. White Paper Preemptive Malware Protection through Detection Table of Contents Executive Summary...2 Response Time to New s The Achilles Heel of the Anti-Virus Industry...3
Countermeasures against Mobile spam
8 July, 2004 Countermeasures against Mobile spam ~ Legislation and Self-regulation ~ Toshihiko SHIBUYA, Deputy Director Telecommunications Consumer Policy Division, Telecommunications Bureau, Ministry
VIETNAM CYBER-SAVVINESS REPORT 2015 CYBERSECURITY: USER KNOWLEDGE, BEHAVIOUR AND ATTITUDES IN VIETNAM
VIETNAM CYBER-SAVVINESS REPORT 2015 CYBERSECURITY: USER KNOWLEDGE, BEHAVIOUR AND ATTITUDES IN VIETNAM 1. Why did ESET Undertake this Report? 2. Report Methodology 3. Key Highlights 4. How Many users in
Security & Phishing
Email Security & Phishing Best Practices In Cybersecurity Presenters Bill Shieh Guest Speaker Staff Engineer Information Security Ellie Mae Supervisory Special Agent Cyber Crime FBI 2 What Is Phishing?
TOP 10 IT SECURITY ACTIONS TO PROTECT INTERNET-CONNECTED NETWORKS AND INFORMATION
INFORMATION TECHNOLOGY SECURITY GUIDANCE TOP 10 IT SECURITY ACTIONS TO PROTECT INTERNET-CONNECTED NETWORKS AND INFORMATION ITSM.10.189 October 2017 INTRODUCTION The Top 10 Information Technology (IT) Security
DDoS Protector. Simon Yu Senior Security Consultant. Block Denial of Service attacks within seconds CISSP-ISSAP, MBCS, CEH
DDoS Protector Block Denial of Service attacks within seconds Simon Yu Senior Security Consultant CISSP-ISSAP, MBCS, CEH 2012 Check Point Software Technologies Ltd. [PROTECTED] All rights reserved. 2012
3-4 DAEDALUS: Practical Alert System Based on Large-scale Darknet Monitoring for Protecting Live Networks
3-4 DAEDALUS: Practical Alert System Based on Large-scale Darknet Monitoring for Protecting Live Networks Mio SUZUKI, Koei SUZUKI, Yaichiro TAKAGI, and Ryoichi ISAWA In a regular organization, major approach
Data Security & Operating Environment
Data Security & Operating Environment Version 1.0, Summer 2018 Last updated: June 21, 2018 https://www.kintone.com/contact/ Contents 1. Service Level Objective (SLO)... 1 2. Availability and Reliability...
Issues, lessons learned through the eyes of JPCERT/CC on the vulnerability handling framework in Japan
Issues, lessons learned through the eyes of JPCERT/CC on the vulnerability handling framework in Japan Masaki Kubo, Takayuki Uchiyama JPCERT Coordination Center Vulnerability Coordination Group Agenda
IBM Managed Security Services for security intelligence
IBM Global Services April 2005 IBM Managed Security Services for security intelligence By: David Mackey, security intelligence Jeff Lahann, security intelligence Page 2 Contents 2 Foreword 3 Introduction
SYMANTEC SECURITY UPDATE JUNE 2005
SYMANTEC SECURITY UPDATE JUNE 2005 Symantec Security Update - June 2005 Worldwide and Japan Monthly report examining recent high severity vulnerabilities, cyber attacks, malicious code and spam activity.
The Evolving Threat of Internet Worms
The Evolving Threat of Internet Worms Jose Nazario, Arbor Networks Why Worm Based Intrusions Relative ease Write once, run everywhere promise can come true Penetration Right past firewalls
Managed Security Services - Automated Analysis, Threat Analyst Monitoring and Notification
Service Description Managed Security Services - Automated Analysis, Threat Analyst Monitoring and Notification The services described herein are governed by the terms and conditions of the agreement specified
Q WEB APPLICATION ATTACK STATISTICS
WEB APPLICATION ATTACK STATISTICS CONTENTS Introduction...3 Results at a glance...4 Web application attacks: statistics...5 Attack types...5 Attack trends...8 Conclusions... 11 2 INTRODUCTION This report
Phishing Activity Trends Report August, 2005
Phishing Activity Trends Report August, 25 Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal consumers' personal identity data and financial
Web Cash Fraud Prevention Best Practices
Web Cash Fraud Prevention Best Practices Tips on what you can do to prevent Online fraud. This document provides best practices to avoid or reduce exposure to fraud. You can use it to educate your Web
Report Course name ABSTRACT. Research and reporting. Survey Report. Nguyen Ngoc Long. Ann Viitala. Adesh Chymariya. Shu Sheng 5/2/2010.
Course name Assignment Authors Research and reporting Survey Nguyen Ngoc Long Ann Viitala Adesh Chymariya Shu Sheng Date of the report 5/2/2010 ABSTRACT CONTENTS 1 INTRODUCTION 3 2 THEORETICAL FRAMEWORK,
vol.15 August 1, 2017 JSOC Analysis Team
vol.15 August 1, 2017 JSOC Analysis Team JSOC INSIGHT vol.15 1 Preface...2 2 Executive Summary...3 3 Trends in Severe Incidents at the JSOC...4 3.1 Trends in severe incidents... 4 3.2 Analysis of severe
Florida Government Finance Officers Association. Staying Secure when Transforming to a Digital Government
Florida Government Finance Officers Association Staying Secure when Transforming to a Digital Government Agenda Plante Moran Introductions Technology Pressures and Challenges Facing Government Technology
Managed Security Services - Endpoint Managed Security on Cloud
Services Description Managed Security Services - Endpoint Managed Security on Cloud The services described herein are governed by the terms and conditions of the agreement specified in the Order Document
CISO Success Strategies: On Becoming a Security Business Leader
SESSION ID: CXO W03 CISO Success Strategies: On Becoming a Security Business Leader Frank Kim CISO SANS Institute @fykim Outline Build Your Business Case Rocket Your Relationships Master Your Message 2
Question 1: What steps can organizations take to prevent incidents of cybercrime? Answer 1:
Cybercrime Question 1: What steps can organizations take to prevent incidents of cybercrime? Answer 1: Organizations can prevent cybercrime from occurring through the proper use of personnel, resources,
MONITORING REPORT ON THE WEBSITE OF THE STATISTICAL SERVICE OF CYPRUS DECEMBER The report is issued by the.
REPUBLIC OF CYPRUS STATISTICAL SERVICE OF CYPRUS MONITORING REPORT ON THE WEBSITE OF THE STATISTICAL SERVICE OF CYPRUS DECEMBER The report is issued by the Monitoring Report STATISTICAL DISSEMINATION AND
Beyond Testing: What Really Matters. Andreas Marx CEO, AV-TEST GmbH
Beyond Testing: What Really Matters Andreas Marx CEO, AV-TEST GmbH Microsoft Security Response Alliance Summit 2013 - July 10th, 2013 1 AGENDA About AV-TEST GmbH Innovations and Presentations The AV-TEST
II.C.4. Policy: Southeastern Technical College Computer Use
II.C.4. Policy: Southeastern Technical College Computer Use 1.0 Overview Due to the technological revolution in the workplace, businesses such as Southeastern Technical College (STC) have turned to computer
Vulnerability Analysis of information systems (Modeling of interaction between information systems and social infrastructures)
Vulnerability Analysis of information systems (Modeling of interaction between information systems and social infrastructures) Ichiro Murase Team Leader of Security Technology Team, Information Technology
Vulnerability-centric assurance activities for MFP PP as a candidate for cpp
Vulnerability-centric assurance activities for MFP PP as a candidate for cpp Fumiaki Manabe JISEC / IPA, Japan September 11, 2013 1 Agenda The security surrounding the MFP PP development for Government
Control Systems Cyber Security Awareness
Control Systems Cyber Security Awareness US-CERT Informational Focus Paper July 7, 2005 Produced by: I. Purpose Focus Paper Control Systems Cyber Security Awareness The Department of Homeland Security
Comparison of Firewall, Intrusion Prevention and Antivirus Technologies
Comparison of Firewall, Intrusion Prevention and Antivirus Technologies (How each protects the network) Dr. Gaurav Kumar Jain Email: gaurav.rinkujain.jain@gmail.com Mr. Pradeep Sharma Mukul Verma Abstract
Japan s Cyber Diplomacy
Japan s Cyber Diplomacy As the importance of cyberspace is increasing, cyber threats are rapidly growing. The Ministry of Foreign Affairs (MOFA) needs to lead international discussions on how to ensure
June 2012 First Data PCI RAPID COMPLY SM Solution
June 2012 First Data PCI RAPID COMPLY SM Solution You don t have to be a security expert to be compliant. Developer: 06 Rev: 05/03/2012 V: 1.0 Agenda Research Background Product Overview Steps to becoming
The situation of threats in cyberspace in the first half of 2018
The situation of threats in cyberspace in the first half of 2018 1. Cyber-attacks (1) Scanning activities in cyberspace a. Overview of unexpected incoming packets to the sensors 1 The number of unexpected
Gujarat Forensic Sciences University
Gujarat Forensic Sciences University Knowledge Wisdom Fulfilment Cyber Security Consulting Services Secure Software Engineering Infrastructure Security Digital Forensics SDLC Assurance Review & Threat
Security Threats & Trends Arvind Sahay, Enterprise Manager India, McAfee
7/26/2005 Security Threats & Trends Arvind Sahay, Enterprise Manager India, McAfee 7/26/2005 Page 2 Outline Some Threats Current Trends Corporate Dilemma Challenges Security solutions available Q&A 7/26/2005
Intelligence Led Corporate Security Programs Why a Business Needs to Setup a Cyber Threat Analysis Unit
Intelligence Led Corporate Security Programs Why a Business Needs to Setup a Cyber Threat Analysis Unit Ian Cook 16th Annual Computer Security Incident Handling Conference Budapest, Hungary June 13-18,
Introducing Next Generation Symantec AntiVirus: Symantec Endpoint Protection. Bernard Laroche Endpoint security Product marketing
Introducing Next Generation Symantec AntiVirus: Symantec Endpoint Protection Bernard Laroche Endpoint security Product marketing Agenda 1 Organizational Risk and Endpoint Challenges 32 Symantec Endpoint