Thursday, November 30, 2017

Credit card fraud down 29% for the first time

Iovation released data collected from its retail and e-commerce subscribers from the 2017 holiday weekend (Nov. 24 – 27, 2017). For the first time in recent years, credit card fraud has dropped from 59 percent of total fraud found in the 2016 holiday week to 42 percent of total fraud found in 2017 the holiday week.

credit card fraud down

This represents a 29 percent decrease from last year’s four-day holiday weekend and demonstrates that online retailers are making strides in their ability to identify and prevent card-not-present (CNP) fraud which has been on the rise since brick and mortar retailers have increased their adoption of EMV card technologies.

Retail transactions: From HoliDAY to HoliWEEK

Iovation data also showed that consumers are doing more of their holiday shopping online in general, with transactions occurring solely on Black Friday and Cyber Monday falling over the past several years. This is the result of a shift in sales strategy from online retailers, who are now extending promotional deals beyond the holiday shopping weekend.

The data shows that 62 percent of consumer’s online retail transactions from Black Friday to Cyber Monday originated from mobile phones/tablets, compared to 55 percent from last year’s holiday season, continuing an increase in m-commerce during the holidays and year-over-year.

“We can infer a number of trends through the analysis of billions of e-commerce transactions processed through our FraudForce platform. Most notable among these is that online retailers who leverage device intelligence are making significant inroads when it comes to proactively preventing card-not-present fraud,” said Greg Pierson, CEO at Iovation. “This type of fraud not only cuts into their bottom line results, it can cause irreparable harm to their brand so this is a meaningful improvement.

Consumer behaviors: Password complacency still reigns

Iovation also conducted a survey of more than 1,000 consumers across four generations to better determine how knowledge of fraud affects online behavior. While 83 percent of respondents understand how to protect themselves online – using a credit card rather than a debit card for online purchases, monitoring credit scores regularly and shopping at well-known retailers – consumers across all demographic groups continue to exercise poor password hygiene.

On the topic of consumer attitudes towards online shopping in the wake of major security breaches that have exposed millions of consumers’ personal information, Pierson continued, “attitudes towards online shopping shows that consumers are becoming better educated about how to protect themselves online. However, they remain largely complacent as it relates to their password hygiene, which is why we are seeing a steady rise in identity theft and account takeovers.”

credit card fraud down

While currently serving as consumers’ primary means of authentication, passwords frequently fail when it comes to both user experience and security. And despite these shortcomings, vulnerable passwords are firmly ensconced in today’s online experience. Of those surveyed, 60 percent of consumers say they are not changing their passwords regularly (less than every 6 – 12 months) and of greater concern, close to 70 percent of consumers say they use the same password across multiple sites, meaning that a hacker can easily take over multiple consumer accounts with just a single compromised credential.

A shift from static, password-based authentication to frictionless, multi-factor authentication is crucial to combat today’s escalating threat environment. Multi-factor authentication combines the best of user experience and heightened security for businesses, using context to determine how trustworthy the user is, and as a result, the appropriate level of authentication required. Simply, dynamic authentication makes the right things easy and the wrong things more difficult, providing additional or less layers of authentication when needed.


from Help Net Security http://ift.tt/2nhugLL

How organizations across industries create and manage policies

MetricStream evaluated 260+ organizations across 15 industries to understand the ways in which organizations create, manage, and communicate policies, the challenges they face, and the types of tools and technologies used to support policy management.

manage policies

A recent surge in corporate governance scandals—including sexual harassment and money laundering allegations at various companies—underscore the importance of robust policy management programs to keep errant behaviors in check. Many organizations have written policies in place, but much more is required to ensure that those policies are adhered to across the enterprise.

To build a pervasive culture of ethics and risk-intelligent behavior, organizations need to ensure that their policies are communicated effectively, and updated regularly in line with regulatory and business changes. Moreover, policy compliance and violations need to be tracked on an ongoing basis and addressed proactively.

Against this backdrop, MetricStream Research surveyed organizations across five key areas: policy management challenges, policy management program structure, policy communication and training, managing policy exceptions, and the technology used to manage policies.

Key findings from this research include:

  • The majority of organizations (55%) are unaware of policy violations that may have occurred.
  • While only 24% of organizations use policy management software, the benefits are significant.
  • 80% of organizations using policy management software on a GRC platform take less than 3 months to author and publish policies, compared to only 55% of organizations using pure-play policy management software.
  • 42% of organizations that require employees to attest to certain policies encountered less than 50 policy violations.
  • 59% of organizations that have mapped their policies to risks and compliance requirements do not consider it challenging to update polices as regulations evolve.
  • The majority of organizations that use standardized policy templates (62%) take less than a quarter to develop and roll out a new policy.

manage policies

Percentage of policies updated in the last year

“Our survey findings indicate that an integrated and consistent approach to policy management can yield significant benefits,” remarked French Caldwell, Chief Evangelist, MetricStream. He continued, “Those surveyed who have mapped policies to risk and compliance requirements, have integrated training into policy management programs, or are using policy management software on a GRC platform are able to create and communicate policies faster, update them effectively, and minimize compliance violations.”


from Help Net Security http://ift.tt/2ixQDee

Apple’s rocky week with passwords in High Sierra [VIDEO]


Apple experienced a high-pressure bug report this week – a way to bypass the root password, no less!

Then there was a superquick fix, and a problem with the fix, and a fix for the fix

…so here’s what happened and what we can learn from it:

(Can’t see the video directly above this line? Watch on Facebook instead.)

Note. With most browsers, you don’t need a Facebook account to watch the video, and if you do have an account you don’t need to be logged in. If you can’t hear the sound, try clicking on the speaker icon in the bottom right corner of the video player to unmute.



from Naked Security http://ift.tt/2AiaZP3

Google sued over iPhone ‘Safari Workaround’ data snooping


Did you use an iPhone in the UK between 1 June 2011 and 15 February 2012?

If you did, you’re one of an estimated 5.4 million people who might one day be in line for a compensation payment from Google over a long-running controversy known as the “Safari Workaround”.

The legal barebones are that a campaign group called Google You Owe Us has launched a “representative action” (similar to a class action in the US) alleging that the search giant:

Took our data by bypassing default privacy settings on the iPhone Safari browser which existed to protect our data, allowing it to collect browsing data without our consent.

Specifically, Google used a bit of JavaScript code – the workaround – to bypass Safari’s default blocking of third-party cookies (set by domains other than those being visited) in order to allow sites within its DoubleClick ad network to track users.

This was despite Google giving assurances that this would not happen to users running Safari with its default privacy settings.

The case involves Safari because it was a browser that by default imposed restrictions on the cookies set by ad networks.

By this point, some US readers might be feeling a sense of déjà vu – all over again.

The origins of the British case lie with the discoveries made by a Stanford University researcher called Jonathan Mayer in 2010, which eventually led to legal cases by the Federal Trade Commission (FTC) and 38 US states in 2012 and 2013 which concluded with Google paying fines of $22.5m (then £15m) and $17m respectively.

Google’s defence has always been that the feature was connected to allow Safari users who’d signed into Google, and opted to see personalised content, to interact with features such as the company’s Google+ button or Facebook likes.

In 2012 it said:

To enable these features, we created a temporary communication link between Safari browsers and Google’s servers, so that we could ascertain whether Safari users were also signed into Google, and had opted for this type of personalisation.

Which seemed like a way of saying that internet services, and people’s interaction with them, was getting so complex that strict lines of privacy and consent were blurring.

The latest UK case will, essentially, see these arguments re-run with a few more years’ hindsight to sharpen the case on both sides.

It’s not the first UK Safari workaround case Google has had to fight: in 2015 the Court of Appeal ruled that the issue had enough merit to allow the litigants involved to sue the company (reportedly settled out of court).

As for iOS users who might qualify for any settlement, there are conditions.

Assuming you were using Safari on a lawfully-acquired iPhone, and didn’t opt out of seeing Google’s personalised ads, you must have been resident in England or Wales both during the period covered by the case, and on 31 May 2017 (Scotland has a separate legal system and isn’t covered).

How users prove this years after the event is not clear, but having used an Apple ID with an iPhone during the period mentioned will probably be enough.

The case is specifically about iPhone users and doesn’t include iPads and OS X computers. Naked Security understands this is for legal reasons (including additional devices complicates matters even though they might also have been affected).

Is this just a dose of bad publicity about mistakes long past?

The possibility of pay-outs from a company like Google will grab headlines, but in the UK in 2017 this has become about deeper issues. As Google You Owe Us states:

Together, we can show the world’s biggest companies are not above the law.

Recently, sentiment has turned against large tech companies for a variety of reasons, including attitudes to privacy, the alleged non-payment of taxes, and the popular perception that some companies have become too big for their boots.

It’s a seeming paradox that describes our age. Millions of us use Google’s software, yet for some at least this is building not love and respect, but suspicion.



from Naked Security http://ift.tt/2irow0p

The Last Jedi arrives, plus 26 other movies coming this December

So many movies, so little time. Every week brings a new crop of them, opening in multiplexes and arthouse theaters across the nation, and arriving in increasingly high volumes on streaming platforms like Netflix. How’s a voracious moviegoer to keep up? That’s where The A.V. Club comes in. The first week of every month, we’ll be previewing all the major movies coming to theaters (or laptops or gaming systems or Rokus) near you, helping narrow down these upcoming releases by making educated guesses on whether they’re worth your time and money.


The Shape Of Water

Select theaters December 1

Mexican genre visionary Guillermo Del Toro (Pan’s Labyrinth, Crimson Peak) has made more than his share of creature features, but his love of monsters has never been more literal than it is in this baroquely whimsical, Cold War-era spin on Beauty And The Beast. In a basically wordless performance, Sally Hawkins stars as a mute cleaning woman working at a high-tech government facility, where she forges a cross-species bond with the towering fishman (Doug Jones, back in prosthetic gills after his similarly aquatic turn in Del Toro’s Hellboy movies) her bosses have fished out of the Amazon. The supporting cast includes Richard Jenkins, Octavia Spencer, and Michael Shannon as the bastardly suit looking to dissect the new “asset.”
Will it be worth your time? This is easily the most sentimental movie Del Toro has ever written and directed; besides an unconventional love story, The Shape Of Water is one of those gushing valentines to the cinema, complete with scenes set in a classic movie palace and lots of lovingly lavish throwback period detail. Thankfully, it’s still plenty grotesque, too, offsetting the gooey romanticism with a different kind of gooeyness—a dash of both kink and gore, refreshing for those who prefer the filmmaker’s more disreputable horror fare to his prestige productions.


Wonder Wheel

Select theaters December 1

Woody Allen stages a dinner-theater downer on the boardwalks and boulevards of sunny 1950s Coney Island. There, unhappily married Ginny (Kate Winslet) falls into an affair with a younger lifeguard (Justin Timberlake, who also incongruously narrates through the fourth wall). But trouble invades paradise quickly with the arrival of gangster’s moll Carolina (Juno Temple), daughter of Ginny’s brutish, alcoholic, working-class husband (Jim Belushi). Like the recent Blue Jasmine, it’s a downward-spiral tragedy performed in the key of Tennessee Williams.
Will it be worth your time? The deluge of sexual assault and harassment accusations currently flowing out of Hollywood has made it even more difficult than usual to ignore the long-term controversy surrounding Allen’s personal life—and frankly, Wonder Wheel’s plot doesn’t make it any easier. On top of that, Woody is just repeating himself here, charting the downfall of another depressed heroine, this time to truly predictable ends. But hey, at least it looks beautiful, thanks to Vittorio Storaro’s cinematography, which is even more ravishingly beautiful than the work he did on Allen’s last movie, Café Society.


The Disaster Artist

Select theaters December 1

The Room, the preeminent Z-grade cult movie of our time, gets the Ed Wood treatment in this adaptation of Greg Sestero’s memoir The Disaster Artist: My Life Inside The Room, The Greatest Bad Movie Ever Made. James Franco (who also directed) stars as The Room’s secretive control-freak auteur, Tommy Wiseau, while his brother Dave Franco takes on the role of Sestero, a wide-eyed model who met the vampiric actor-writer-director in a theater class and became his friend, roommate, and co-star. Part of the enduring fascination of The Room lies in the harebrained melodrama’s blatant personal undercurrents, but this movie, which was made with Wiseau’s blessing, leaves most questions about the origins of the film and its singular creator unanswered.
Will it be worth your time? We may be in the minority on this, considering the warm reception that has greeted the film at festival screenings, but The Disaster Artist struck us as less a movie than an over-extended Funny Or Die skit packed with celebrity cameos—which is to say, it makes little sense if you haven’t already seen The Room. This is Franco’s 18th feature as a director, and after years of hacking out unwatchable biopics and literary adaptations (including this year’s In Dubious Battle), he has matured into completely anonymous, tone-deaf semi-competence.


The Other Side Of Hope

Select theaters December 1

Returning to his homeland for the first time since 2006’s Lights In The Dusk, the stoically quirky Finnish writer-director Aki Kaurismäki remains steadfast in his commitment to droll humor, twangy rock music, and self-plagiarizing shaggy-dog stories. Partially refining Le Havre’s refugee plot, he splits his latest evenly between two characters: a Syrian stowaway (Sherwan Haji) who arrives in Helsinki in the coal hold of a Polish freighter and a shirt salesman (Sakari Kuosmanen) who has decided to remedy his midlife crisis by buying a failing restaurant. The similarities between the two men—both trying to start over in humbling circumstances—are blatant enough to be schematic, but that’s sort of the point.
Will it be worth your time? While earlier Kaurismäki films like Shadows In Paradise and The Man Without A Past were deadpan, blue-collar subversions of melodramatic plot points and classic film genres, this is pure self-commentary, best appreciated by fans. The restaurant scenes feature some of his hackiest humor, but the passages that deal exclusively with Haji’s character contain some of Kaurismäki’s purest filmmaking, harkening back to the early days of sound film.


Loveless

Select theaters December 1

Trapped in a dead-end marriage that’s long since devolved into bitter animosity, unfaithful spouses Boris (Alexey Rozin) and Zhenya (Maryana Spivak) have one thing in common: Neither has much affection for the 12-year-old son (Matvey Novikov) caught in the middle of their spats. So what will happen when the boy disappears? This latest beautiful bummer from Russian director Andrey Zvyagintsev (Elena, Leviathan) starts out like an especially grueling divorce drama, before transforming into an almost darkly comic missing-child procedural.
Will it be worth your time? Depends on how much feel-bad you can stomach. This is one of Zvyagintsev’s most formally accomplished and conceptually daring movies, even if you don’t get everything the director is trying to communicate about his country and the Ukraine. But like just about everything else he’s made, it’s also a really bitter pill to swallow, especially given that it involves the potential kidnapping of a sad, neglected child. Be prepared.


Just Getting Started

Theaters everywhere December 8

No, this isn’t Going In Style, Last Vegas, or The Bucket List, but a (technically) different entry in the decade-long cycle of old-codger comedies that star Morgan Freeman and a rotating assortment of non-Morgan Freemans. The sonorous octogenarian plays the local stud of an upscale retirement complex, who may also be a former mob associate hiding out in witness protection. (The trailer is somewhat confused on this seemingly important plot point.) The non-Morgan Freeman this time around is Tommy Lee Jones; the master of disapproving stares plays a retired FBI agent who moves into the community, messes with the Freeman character’s golf game, and possibly helps him evade hit men. (Again, the trailer isn’t very clear on this.)
Will it be worth your time? Writer-director Ron Shelton is the man behind the beloved Bull Durham, the fondly remembered White Men Can’t Jump, and the semi-liked Tin Cup. Unfortunately, his batting average (or handicap or what have you) with everything except sports movies is less than stellar; Just Getting Started is his first feature since 2003’s charmless Hollywood Homicide.


I, Tonya

Select theaters December 8

Margot Robbie disappears into the best role of her still-burgeoning career to play disgraced figure skating sensation and ’90s tabloid “star” Tonya Harding. Building inexorably to the kneecap clubbing heard ’round the world, I, Tonya gives Harding’s life, career, rise, and fall the Goodfellas treatment, complete with lots of rock ’n’ roll needle drops and sardonic voice-over narration. The film’s not-so-secret weapon: Allison Janney as Tonya’s profanity-spewing stage mother from hell, literally beating the need to win into her gifted daughter.
Will it be worth your time? I, Tonya’s Scorsese-indebted assault on the fourth wall can be a little glib, but Robbie deserves all the acclaim she’s already received—for magnetically capturing Harding’s on- and off-the-ice attitude, and for revealing the layers of disappointment beneath. At its best, this entertaining biopic looks past the headlines to deeper questions of class and upward mobility, as Harding faces off against not just the other skaters, but also judges and promoters who resent someone of her low-income upbringing dominating the sport.


Foxtrot

Select theaters December 8

Told in three parts, this controversial drama from Israeli writer-director Samuel Maoz (Lebanon) concerns a Tel Aviv couple shell-shocked by the news that their son, a soldier of the Israeli Defense Forces, has been killed in action. But what really happened on that fateful day in the field? After winning the Grand Jury Prize at Venice, Foxtrot was condemned—possibly sight unseen—by Israel’s minister of culture, who insisted that it promotes a negative, misleading impression of the IDF. Despite this anti-endorsement, the film has also been selected as Israel’s official submission for the Foreign Language Oscar.
Will it be worth your time? Foxtrot has earned mostly glowing reviews from the festival circuit, and its divisiveness—the fact that it’s been both denounced and promoted by its country’s cultural gatekeepers—is all the more reason to be curious. Plus, the bereaved father is played by the terrific Lior Ashkenazi, from Late Marriage and Footnote.


Quest

Select theaters December 8

Although it spans the entire length of the previous presidency, from inauguration to those last few days in office, and features ominous televised footage of the man who would start mucking things up in the White House shortly thereafter, Quest isn’t exactly the definitive documentary portrait of “the Obama years.” Instead, it uses that recently elapsed cultural era as a framework for an intimate portrait of a North Philadelphia family, opening its home music studio to the city’s hip-hop community and weathering nearly a decade’s worth of hardship.
Will it be worth your time? Following his subjects for eight years allows director Jonathan Olshefski to show how circumstances change (or, pointedly, sometimes don’t change) over time, all while getting us invested in lives that refuse to conform to any tidy narrative arc. Opening in theaters almost a year after it emotionally captivated audiences at Sundance, Quest is further proof that the Steve James model of long-term filming commitments pays big dramatic dividends.


Star Wars: The Last Jedi

Theaters everywhere December 15

“Let the past die,” murmurs Adam Driver’s black-helmeted black hat Kylo Ren in the trailer for The Last Jedi. Will The Empire, a.k.a. Disney, take his advice and allow the latest installment of the triumphantly reborn Star Wars saga to put what came before it to rest? Certainly, episode 10 will continue what J.J. Abrams started with episode nine, placing Rey (Daisy Ridley) under the tutelage of grizzled saber-wielder Luke Skywalker (Mark Hamill), while reenlisting John Boyega’s Finn, Oscar Isaac’s Poe Dameron, and perennial fuzzball Chewbacca in the ongoing rebellion. Whether The Last Jedi blazes its own path across the galaxy far, far away or follows the one forged a long time ago remains to be seen. Either way, it will almost certainly be the biggest hit of the year, if not of all time.
Will it be worth your time? As if anyone needs to be told to go see this movie. Exciting as it may be to spend more time with the (admittedly pretty cool) characters introduced in The Force Awakens, what has us at The A.V. Club amped is the opportunity to see what writer-director Rian Johnson (Brick, Looper) builds in the Lucasfilm sandbox. Even if he ends up sticking close to the trajectory of The Empire Strikes Back, the same way Abrams basically traced over A New Hope, it’s helpful to remember that Empire was, you know, awesome. Bring on the even darker side of the Force!


Ferdinand

Theaters everywhere December 15

Munro Leaf’s children’s classic The Story Of Ferdinand, about a pacifist bull who’d rather smell flowers than chase after matadors, gets the big-screen treatment in an animated film that features the voices of John Cena, Kate McKinnon, and, uh, Peyton Manning. It took Leaf only an hour to write the original book, which was adapted into an Oscar-winning cartoon short by Disney in 1938; the makers of Ice Age and Rio apparently think they can wrench 107 minutes out of this material. (Disney only managed seven.)
Will it be worth your time? Blue Sky’s previous attempt at adapting a beloved bedtime read gave us the middling Horton Hears A Who! Expect visual competence, but not much more.


Wormwood

Select theaters and Netflix December 15

Dramatic re-creations have been a staple of Errol Morris’ work since his seminal 1988 justice-system procedural The Thin Blue Line. But Wormwood expands that divisive aspect of the documentary legend’s methodology into uncharted territory, as Morris combines his famously hard-hitting interview style with scripted scenes starring Peter Sarsgaard as a man determined, for several decades, to find out what happened to his father, a scientist who died during the Cold War while working on a top-secret program. The film is being released two ways: in a roughly four-hour theatrical cut and as a six-part Netflix miniseries.
Will it be worth your time? Morris’ re-creations have always irked doc purists, and early word on Wormwood is that it blurs the line between fiction and nonfiction filmmaking even more than usual. But for those not bothered by that medium-crossing approach to a true story, this is probably a must-see; buzz is that Wormwood is the filmmaker’s most exciting, ambitious movie in ages—a labyrinthine investigative epic, rich with conspiracy theory intrigue.


The Ballad Of Lefty Brown

Select theaters December 15

Jared Moshe, the writer-director of the throwback Western programmer Dead Man’s Burden, returns with another straightforward take on film’s most mythologized genre. Doing his best impression of a classic character actor in the Gabby Hayes mold, a scraggly-bearded Bill Pullman stars as the title character, a lifelong Old West sidekick who finds himself on his own after his legendary compadre (Peter Fonda) is killed by cattle rustlers. Accompanied by two pals from their gun-fighting days (Tommy Flanagan, Jim Caviezel), Pullman’s cowboy coot sets off in pursuit of vengeance.
Will it be worth your time? The Ballad Of Lefty Brown premiered at this year’s SXSW, and early reviews promise a solid oater that pays off the promise of Moshe’s shoestring-budget debut.


The Leisure Seeker

Select theaters December 15

Giving the torturous progression of Alzheimer’s disease a Sundance-style treatment, The Leisure Seeker finds Helen Mirren and Donald Sutherland playing a retired couple on a latter-day road trip to visit Hemingway’s house, ostensibly as a gift for Sutherland’s aging intellectual. However, he’s also beginning to suffer from the effects of the memory-shredding illness, and as the two progress across the country, they grapple with what it means to suffer such an ignominious end to a happy long-term relationship.
Will it be worth your time? Italian writer-director Paolo Virzì (Human Capital) is an old pro at crafting crowd-pleasing films that also rack up awards. This English-only offering (his first full-length feature shot solely in the language) is a loose adaption of the novel of the same name, but it appears to have lost something in translation, as early reviews have faulted the movie for coming across like exactly the sort of treacly feel-good nonsense threatened by the trailer. Still, it’s got Mirren and Sutherland playing off each other, which surely counts for something.


Jumanji: Welcome To The Jungle

Theaters everywhere December 20

Tasked with crafting a decades-later sequel to the 1995 family hit while also overcoming the gloomy shadow of Robin Williams’ death, Jumanji: Welcome To The Jungle sidesteps both of those things, along with most of the original’s premise, with this quasi-reboot. Jumanji is now a video game from the ancient Super Nintendo era, magically sucking in four classic teen movie stereotypes and transforming them all into avatars played by Dwayne Johnson, Kevin Hart, Karen Gillan, and Jack Black, then forcing them to contend with rampaging jungle animals.
Will it be worth your time? Anyone harboring some protective grudge about a Jumanji sequel without Williams may be mollified to learn that his Allan Parrish serves as a sort of spiritual guide within the film, thus preserving the integrity of this now-franchise. But for most people, it comes down to the desire to see Johnson, Hart, et al. do extended Freaky Friday riffs on being awkward adolescents trapped in very adult bodies, in between being chased by monkeys.


The Greatest Showman

Theaters everywhere December 20

It’s Hugh Jackman, isn’t it? (He can act! He can dance! He can sing!) The four-time host of the Tony Awards continues to expand his repertoire with this fanciful, possibly ill-conceived musical biopic, taking on the role of P.T. Barnum, the 19th-century promoter whose name is synonymous with hoaxes and cynical business practices. Casting the tall, handsome Jackman as the very un-hunky, Harvey-Pekar-looking Barnum might seem like a stretch, but hey, people said no one would buy him as Wolverine. We’ll see if cloying paeans to the circus will outlive the actual big-top business. Michelle Williams, Rebecca Ferguson, Zac Efron, and Zendaya lead the supporting cast.
Will it be worth your time? Let’s hope that, in a Barnum-esque twist, The Greatest Showman has been grossly misrepresented by its gooey, saccharine trailers. Because what we’ve seen so far looks like a big, flat waste of the talent involved, and the original songs (by La La Land lyricists Benj Pasek and Justin Paul) sound like they were machine-generated by a computer that was fed nothing but Radio Disney playlists from 2013.


The Post

Theaters everywhere December 22

American godheads Steven Spielberg and Tom Hanks join forces for the fifth time for this drama about the 1971 publication of the Pentagon Papers, the leaked Department Of Defense study that not only revealed the scope and goals of the United States’ involvement in Vietnam, but also exposed its covert bombing campaigns in nearby Cambodia and Laos. Meryl Streep stars as Katharine Graham, the publisher of The Washington Post; Hanks plays executive editor Ben Bradlee, the same role that won Jason Robards an Oscar for All The President’s Men. The intriguing, character-actor-packed ensemble cast includes Tracy Letts, Bruce Greenwood, Carrie Coon, Jesse Plemons, Matthew Rhys, Michael Stuhlbarg, Pat Healy, and both Bob Odenkirk and David Cross.
Will it be worth your time? Stage-bound and tenuously plotted, The Post is one of Spielberg’s less dramatically involving mediations on moral values and legal fine print; despite some astute observations on the sometimes toxically cozy relationship between the media and the politicans they cover, it struggles to find a center to its story.


Pitch Perfect 3

Theaters everywhere December 22

Ready the pun generator, because the pitches are back for a third spin around the aca-track in Pitch Perfect 3. Those signature bits of wordplay are all but guaranteed to show up in this third installment in the surprisingly successful comedy series about all-female a cappella group the Barden Bellas, who reunite for a USO tour hoping to recapture some of their former glory after failing in their initial attempts at post-college life. Keep an eye out for Ruby Rose in a supporting role as leader of a rival all-girl rock group.
Will it be worth your time? Even the trailer for the film—featuring quick shots of an airplane hangar, a blender mishap, nunchucks, a John Woo-style boat explosion, Rebel Wilson beating up an inflatable shark, and even some (gasp) singing—seems to acknowledge that the aca-franchise is past its expiration date narratively. So only check this one out if you’re a fan of the first two and can’t bear to say goodbye to your pals Anna Kendrick and Wilson yet.


Father Figures

Theaters everywhere December 22

In this bro-comedy spin on Mamma Mia, fraternal twins Owen Wilson and Ed Helms—guess who’s the “uptight” one—undertake a quest to find their real dad, after their mom (Glenn Close) confesses it could have been any of her free-love ’70s paramours. The candidates include Christopher Walken, Ving Rhames, J.K. Simmons, and even Terry Bradshaw as himself, all offering variations on their particular shticks. Meanwhile, Katt Williams is a potentially dangerous man, and he also plays a hitchhiker.
Will it be worth your time? From its shrug of a title (diluted from its original Bastards), to its two years spent in release limbo, to the writing-directing team-up of Office Christmas Party’s Justin Malen and The Hangover cinematographer Lawrence Sher, to a lumpy contrivance of a premise that packs every road-trip comedy cliché into a series of wacky dad vignettes, Father Figures feels very much like the overlooked middle son of a committee—one who’s hoping you won’t be fully sated on filial slapstick after Daddy’s Home 2. Hey, when’s the last time you called your own dad? You know, someday he’s gonna die, and you’ll have wasted 90 minutes you could have spent having an emotional breakthrough on Rhames calling Close a “dick whisperer.”


All The Money In The World

Theaters everywhere December 22

It’s not uncommon for ads to feature takes, camera angles, or even scenes that don’t end up in the finished film. But what about an entire performance? The above trailer for All The Money In The World, Ridley Scott’s upcoming thriller about the 1973 kidnapping of a teenage heir to the Getty oil fortune, is already obsolete. As allegations about Kevin Spacey’s history of sexual assault and predation began to mount, Scott took the unprecedented step of recasting his part and reshooting key portions of the film; ironically, that meant giving the role of tycoon J. Paul Getty to Scott’s first choice, Christopher Plummer, who had been passed over by the studio in favor of the more “bankable” Spacey. Michelle Williams and Mark Wahlberg star as, respectively, the kidnapped boy’s mother and a former CIA agent hired by the family to investigate the kidnapping.
Will it be worth your time? To say that this formerly low-profile, mid-budget later-period Ridley Scott project has been overshadowed by its behind-the-scenes drama would be an understatement. Intent on keeping the film’s original release date, the director and his team are reworking their film in a matter of weeks. But if anyone can move a Hollywood production that quickly, it’s Scott.


Bright

Netflix December 22

Netflix shelled out $90 million to acquire this Max Landis-scripted supernatural buddy-cop thriller, a Tolkien-ified spin on Alien Nation that casts Will Smith as a quippy, Will Smith-y LAPD officer who’s partnered with Joel Edgerton’s orc in a world where archetypes from mythology and urban gang dramas uneasily coexist. The two quickly go from banter-filled routine patrols to being thrown into the CGI shit after a witch and elf begin their epic battle over a magic wand.
Will it be worth your time? The curiosity factor is certainly high on the streaming service’s first aspiring blockbuster, a movie that looks every bit the big-screen effects extravaganza—right down to its sickly neon glow and cacophony of slow-motion fight sequences. Director David Ayer seems to be aiming to combine the Xbox spectacle of his Suicide Squad with his two-hander End Of Watch, plus a dash of Smith’s usual cool-action-hero coasting. It’s another potentially mismatched partnership, but hey, at least your own investment won’t require leaving the couch.


Downsizing

Select theaters December 22

In a world where scientists have found a way to reduce human beings to a fraction of their original size, mostly for purposes of preserving scarce natural resources, shrinking to mouse proportions is the new route to high living. After all, everyone can afford a mansion that’s only as large as a dollhouse. That’s the conceit of the first bona fide “special effects movie” by Alexander Payne, the Oscar-winning writer-director of Sideways and Nebraska. Matt Damon plays the working stiff who decides to get small to live large, but comes to suspect that “downsizing,” as the voluntary procedure is called, may have been a big mistake.
Will it be worth your time? Even those with a yen for Payne’s particular brand of Midwestern tragicomedy may leave his latest wishing that someone with a slightly, uh, bigger imagination had tackled this same premise. Satirically speaking, Downsizing is fairly one-note, and although a world of tiny people provides almost endless dramatic and comedic possibilities, Payne eventually kind of abandons his high concept for an earnest environmental tract. It’s one of his weakest movies.


Hostiles

Select theaters December 22

Call it the Year Of “Actually, It’s A Western.” Scott Cooper (Out Of The Furnace, Crazy Heart) brings his brand of pensive macho posturing to the American frontier with this drama about a hard-hearted Army captain (Christian Bale, sporting a glorious walrus mustache) ordered to escort his terminally ill Cheyenne nemesis (Wes Studi) to sacred ground. The relationship between these two old fighters with a shared violent past recedes into the background of the largely episodic narrative; among the twisted reflections they encounter are a grieving frontierswoman (Rosamund Pike) and a condemned murderer (Ben Foster) who relishes underlining the film’s themes.
Will it be worth your time? Cooper is an old hand at creating individual scenes that evoke characters’ flaws and emotional backstories through a minimum of words and gestures, but the bigger picture seems to elude him. The result is a grimly obvious film with unexpected grace notes.


Happy End

Select theaters December 22

Just in time for Christmas comes the latest and possibly final act of audience antagonism from the reigning scold of European art cinema, Michael Haneke. Happy End gazes, with exacting formal precision, upon the members of a coldly bourgeois European family, played by such alums of the director’s dispiriting filmography as Isabelle Huppert and Amour star Jean-Louis Trintignant. The title, as any Funny Games “fan” could probably surmise, is bitterly ironic.
Will it be worth your time? Haneke has suggested that this could be his swan song, which helps explain why it often plays like a greatest-hits collection, drawing together elements, obsessions, and even characters (Trintignant seems to be playing the same person he did in Amour) from his entire body of work. Unfortunately, that results in the rare sense that this uncompromising filmmaker is just repeating himself. Without any new insights, Happy End does little more than confirm every unfair sling and arrow fired against Haneke; it’s as if he’s gone out of his way to prove his staunchest detractors right.


Phantom Thread

Select theaters December 25

The latest from director Paul Thomas Anderson reteams him with Daniel Day-Lewis for another character study of a ruthlessly driven and difficult man. Day-Lewis plays dressmaker Reynolds Woodcock, whose glamorous bachelor’s life in 1950s London is upended after he falls for a headstrong young woman (Luxembourgian actor Vicky Krieps).
Will it be worth your time? Anderson’s previous collaboration with Day-Lewis, 2007’s There Will Be Blood, was one of the best films of the 21st century so far. And while Phantom Thread’s dressing room drama promises to be far more intimate in scope, there’s every reason to expect it will be a similarly riveting actors’ showcase—and if you believe Day-Lewis, it’s also his last. Yes, see it.


Molly’s Game

Select theaters December 25

Jessica Chastain leads a cast of A-listers in the belated directorial debut of venerated screenwriter Aaron Sorkin. The film is based on the true story of Molly Bloom (Chastain), a former Olympic skier who made her reputation—and a lot of money—running discreet underground high-stakes poker games for wealthy clients that included movie stars, powerful businessmen, professional athletes, and, eventually, the Russian mob. After Molly gets busted by the FBI, her defense lawyer, Charlie Jaffey (Idris Elba), also becomes her only ally as her story becomes a tabloid sensation.
Will it be worth your time? Based on early reviews out of Toronto, Molly’s Game fits the profile of a screenwriter’s directorial debut, going light on visual flair but heavy on dialogue—gushing torrents of uber-witty, stylized dialogue delivered at breathtaking speed, as the case may be. If you’ve already been initiated into the cult of Sorkin, a solid two-hour chunk of his signature writing style promises to be pure bliss. But the film probably won’t produce any new converts either.


In The Fade

Select theaters December 27

In this topical drama from German director Fatih Akin (Edge Of Heaven, Head-On), Diane Kruger stars as a grieving widow whose husband, a Turkish immigrant, and 6-year-old son are killed in a terrorist bombing. The likely culprits: “very fine people” of the neo-Nazi persuasion. In The Fade chronicles our heroine’s emotional journey, from snorting and free-basing her pain away to taking on the racist perpetrators in court to considering more extreme routes to justice.
Will it be worth your time? There’s no denying the sad, scary timeliness of Akin’s subject matter; although the film is set in Germany, it could easily be relocated to America or any other Western country currently experiencing a spike in violence committed by white supremacists. As a recovery or revenge drama, however, In The Fade is movie-of-the-week generic, following a highly predictable trajectory, even with Kruger pouring herself into the role of a woman seized with grief and rage.


Film Stars Don’t Die In Liverpool

Select theaters December 29

Director Paul McGuigan is much better known for cheerfully low-rent genre silliness (Push, Lucky Number Slevin, Victor Frankenstein) than for penetrating character studies, but Film Stars Don’t Die In Liverpool finds him helming a much lower-key story. An adaptation of a memoir, the ’80s-set film largely looks to be a chance for Annette Bening to deliver an awards-bait turn as real-life aging film star Gloria Grahame, who falls in love with a decades-younger actor (Jamie Bell), providing a much-needed gender swap on the usual May-December romances offered up by Hollywood.
Will it be worth your time? If you don’t mind the melodramatic tone, both Bening and Bell reportedly turn in stellar performances, and the film tells the story of their romance in flashback, allowing plenty of time for the actors’ chemistry to build and create a satisfying and plausible relationship. It may not be top-tier cinema, but it could provide some charming counter-programming amid the holiday blockbusters.


from Lifehacker http://ift.tt/2jzstwn

Stealthy in-browser cryptomining continues even after you close window

In-browser cryptocurrency mining is, in theory, a neat idea: make users’ computers “mine” Monero for website owners so they don’t have to bombard users with ads in order to earn money.

Unfortunately, in this far-from-ideal world of ours, mining scripts – first offered by Coinhive but soon after by other outfits – are mostly used by unscrupulous web admins and hackers silently compromising websites.

A lucrative enterprise

As ad-blocking services and antivirus vendors began blocking Coinhive’s original script, the developers created a new API that prevents website owners from forcing the cryptomining onto their visitors without their permission.

But, as the initial API still has yet to been retired, it’s not shocking that it’s still much more popular and widespread than the second one.

AdGuard researchers recently found 33,000 websites running cryptojacking scripts, and 95% of them run the Coinhive script.

“We estimate the joint profit at over US $150,000 per month. In case of Coinhive, 70% of this sum goes to the website owner, and 30% to the mining network,” they noted.

That’s $45,000 per month for Coinhive, and over half a million if the situation were to remain unchanged. This is also the most likely reason why Coinhive has not retired the original miner script.

Keeping those browsers mining

But, as adblockers and some AV vendors are ramping up their efforts to block cryptojacking scripts from running, the crooks have to come up with new ways to keep them unnoticed. They are also testing new ways for keeping browsers open and mining even if the users leave the mining website.

Malwarebytes’ researchers detailed one of these efforts, which involves covert pup-under windows, throttled mining, and an ad network that works hard on bypassing adblockers.

The “attack” unfolds like this: the user visits a website that silently loads cryptomining code and starts mining, but throttles it so that user’s CPU power is not used up completely. This prevents the machine from slowing down and heating up, and makes it more likely that the user won’t notice the covert mining.

But, when the user leaves the site and closes the browser window, another browser window remains open, made to hide under the taskbar, and continues mining.

“If your Windows theme allows for taskbar transparency, you can catch a glimpse of the rogue window. Otherwise, to expose it you can simply resize the taskbar and it will magically pop it back up,” Malwarebytes researcher Jerome Segura explained.

browser cryptomining

The rogue pop-under window can then be closed, and the mining stopped. Unfortunately, too many users won’t notice it or notice for a while that their computer has become somewhat sluggish.

“This type of pop-under is designed to bypass adblockers and is a lot harder to identify because of how cleverly it hides itself,” Segura noted.

“The more technical users will want to run Task Manager to ensure there is no remnant running browser processes and terminate them. Alternatively, the taskbar will still show the browser’s icon with slight highlighting, indicating that it is still running.”

The researchers tested the scheme by using the latest version of the Google Chrome browser on Windows. Results may vary with other browsers and other operating systems.

Chrome developers have been debating whether the browser should block or flag CPU mining attempts since early September, but a decision has still not been made.


from Help Net Security http://ift.tt/2isboI6

Mr. Robot eps3.7_dont-delete-me.ko – the security review


You can tell we’re nearing the end of the season – this episode was a deep breath before we plunge into the finale.

Not much to talk about on the tech and security front this time, just the one thing we’ll explore below. To fully recreate the mood from this episode, fire up the Bill & Ted’s Excellent Adventure original soundtrack and we’ll head Back To The Future for more analysis.

WARNING: SPOILERS AHEAD – SCROLL DOWN TO READ ON

 

“Don’t delete me”

I was despairing a little that I wouldn’t have anything to write about for this week as the episode went on. Thankfully, right at the end of the episode, the briefest glimpse of Trenton’s last email to Elliot gives us something to examine. My sincere thanks to the many fast screencappers out there who were able to catch Trenton’s email (sent to and from Protonmail accounts, a service well-loved by Five/Nine).

Let’s take a look piece by piece:

I may have found a way to undo the hack. I’ve been investigating Romero. He installed hardware keyloggers on all the machines at the arcade some time before five/nine.

Remember Romero, the older phone-phreaker member of Five/Nine, who we parted ways with at the beginning of season two? He had a few things up his sleeve, and by installing keyloggers on the arcade machine he would theoretically be able to easily keep an eye on anything people were typing on those machines. Software keyloggers, often paired with malware, usually “call home” somewhere with the information they gather. Romero, however, installed hardware based keyloggers – as the name implies, they are somewhere plugged into the computer itself and are designed to be part of, or look like, normal hardware or periphery.

Hardware keyloggers sit in the middle of the target computer and its periphery, quietly logging everything that passes through it, allowing it to snoop undetected by the victim machine. Given Romero’s nifty booby trapped hardware hacks, which we saw explode back in season 2, it’s not surprising that his hardware keylogger was subtle enough to fool even the Five/Nine team for a good while.

The NYPD imaged all of his data after he was murdered. I was able to get this chain of custody document from the NYPD when they prepared to transfer the evidence to the FBI.

“Imaged,” meaning they made a direct copy of all the contents of his hard drive (the disk image).

They couldn’t get into the encrypted keylogger containers.

Romero had grabbed the keylogger data from his nifty hardware keyloggers and regularly dumped that data onto his hard drive. The keylogged data itself was encrypted (I would presume his hard drive was too).

If Romero somehow got a hold of the keys, or even the seed data and source code for the encryption tools, the answer might be in those keylogger captures, but the FBI probably has those files now.

The keys Trenton’s referring to here are the keys needed to decrypt the keylogger data. The next bit, about the seed data and source code, means Trenton thinks there’s way to potentially reverse-engineer the key used to encrypt the data.

Ideally, encryption protocols shouldn’t allow any part of the the key to be figured out from the encrypted data stream, and but the email here implies that the process wasn’t cryptographically secure, so that it might be possible to winkle out out the decryption key, or to unscramble the data without the key, after all.

Perhaps Romero wasn’t a crypto nerd and this was a mistake, but it’s more likely this was by design so he could decrypt the data without having to remember or carry around a key. After all, an encryption key could look like this…

-----BEGIN RSA PRIVATE KEY-----
MIHtAgEAAjAAziOgSCYfbckh5tLO1ztkj/ggT80/3KOj2jQBTeJtPqX+3l8pen/V
yNGbv4+pRF0CAwEAAQIveUhuwmRjs3VWU/eOKQZRyX8Ei89IFqnED3JChX5RP4kE
8Ixl/6p+i1+NMDW4MoUCGA8nge3DNwNone+ifAqSxgeNgSg+Wug/LwIYDZpH/uwK
csRIfwb6M5X2COjcmAWSarIzAhgLbu47GU6XNsX5tyhIveXEawFoAGuLz6cCGA1g
oVVvRYdAyhtC/WUmIeT5PZi0Qh50SQIYBunB28gYf39am7WDp4GKeb696mmFgYeH
-----END RSA PRIVATE KEY-----

…whereas the seed to generate the key could be something as easy as a few digits of his choosing, like his birth year, or I don’t know, 5/9.

The next step seems pretty clear: I wouldn’t be surprised if Elliot and Dom work together to undo the hack, where Dom has access to the files and Elliot will need to decrypt them.

If they’re successful in stopping Whiterose and Dark Army’s next attack, they’d have Romero’s healthy hacker paranoia to thank. That would be some fantastic justice from the phreaker set for sure.



from Naked Security http://ift.tt/2kcksRW

UK shipbroker Clarksons refuses to pay hackers ransom for stolen data

London-based shipbroking firm Clarksons has suffered a data breach and refuses to pay the attackers to prevent the stolen data from being publicly released.

Clarksons data breach

About the Clarksons data breach

“Our initial investigations have shown the unauthorised access was gained via a single and isolated user account which has now been disabled,” the company shared in a notice published on Wednesday, and warned that “the person or persons behind the incident may release some data.”

The company said that they will be contacting potentially clients and individuals directly in the coming days.

They did not disclose any further information about the cybersecurity incident as the investigation is still ongoing, so it’s currently unknown what type od sta has been compromised.

“As you would rightly expect, we’re working closely with specialist police teams and data security experts to do all we can to best understand the incident and what we can do to protect our clients now and in the future. We hope that, in time, we can share the lessons learned with our clients to help stop them from becoming victims themselves,” Clarksons CEO Andi Case noted.

“In the meantime, I hope our clients understand that we would not be held to ransom by criminals, and I would like to sincerely apologise for any concern this incident may have understandably raised.”

The fallout

Since the discovery of the incident, the company has put in place additional security measures to prevent future similar accidents. “The Company is continuing with a wider review of cyber security that began earlier this year and is, for example, accelerating the roll-out of various additional IT security measures,” they added.

Since the publishing of the notice, there has been no news about the stolen data being leaked.

Despite the company saying that the incident has not affected its ability to do business, shares in Clarksons fell by more than 3.5% after the breach announcement.


from Help Net Security http://ift.tt/2zPkWo9

NSA "Red Disk" Data Leak

ZDNet is reporting about another data leak, this one from US Army's Intelligence and Security Command (INSCOM), which is also within to the NSA.

The disk image, when unpacked and loaded, is a snapshot of a hard drive dating back to May 2013 from a Linux-based server that forms part of a cloud-based intelligence sharing system, known as Red Disk. The project, developed by INSCOM's Futures Directorate, was slated to complement the Army's so-called distributed common ground system (DCGS), a legacy platform for processing and sharing intelligence, surveillance, and reconnaissance information.

[...]

Red Disk was envisioned as a highly customizable cloud system that could meet the demands of large, complex military operations. The hope was that Red Disk could provide a consistent picture from the Pentagon to deployed soldiers in the Afghan battlefield, including satellite images and video feeds from drones trained on terrorists and enemy fighters, according to a Foreign Policy report.

[...]

Red Disk was a modular, customizable, and scalable system for sharing intelligence across the battlefield, like electronic intercepts, drone footage and satellite imagery, and classified reports, for troops to access with laptops and tablets on the battlefield. Marking files found in several directories imply the disk is "top secret," and restricted from being shared to foreign intelligence partners.

A couple of points. One, this isn't particularly sensitive. It's an intelligence distribution system under development. It's not raw intelligence. Two, this doesn't seem to be classified data. Even the article hedges, using the unofficial term of "highly sensitive." Three, it doesn't seem that Chris Vickery, the researcher that discovered the data, has published it.

Chris Vickery, director of cyber risk research at security firm UpGuard, found the data and informed the government of the breach in October. The storage server was subsequently secured, though its owner remains unknown.

This doesn't feel like a big deal to me.

Slashdot thread.


from Schneier on Security http://ift.tt/2ByuZer

Richard Ford: A physicist’s strange journey to become an infosec scientist

Many of today’s information security professionals started their path towards a career in the industry by becoming frustrated gamers. Richard Ford, Chief Scientist at Forcepoint, is one of them.

richard ford forcepoint

His particular frustration was fuelled by the fact that he couldn’t save game scores and prove everyone how good a player he was. In order to write a program to copy the screen to a file, he had to hack the games. Eventually, though, the games became less interesting than walking through the code, so that’s where he spent most of his time.

“Because of that history, I basically fell into this field, which is pretty common for people who got into computer security in the late 80s and early 90s,” he says.

Infosec beginnings

With an academic background in physics but an active interest in computing and hacking, Ford started his career in the information security field when a visit-cum-job interview at Virus Bulletin ended up in him being installed as an editor at the publication.

“My career path has been non-traditional but also pretty rewarding – everything from my time in academia at the Florida Institute of Technology to my years as a journalist plays a role. When I first started writing, my editor would cross out almost every single word in my articles to whip me into becoming a better writer. That particular skill comes in hand daily, helping me to communicate more clearly.”

“We often make cybersecurity sound complex, but in reality the basic ideas are very simple – and being able to explain that is critical,” he points out. “For this reason, I have grown to love these complementary ‘softer’ skills that very technical people are so often lacking.”

Work at Forcepoint

His work at Forcepoint is a dream come true: he can see the ideas he’s worked on in action, protecting people in the real world.

But, he notes, the choice on what technologies to research for potential implementation is not wholly his.

“There’s no single person here at Forcepoint who mandates, ‘oh, we’re going to research this piece of tech.’ I certainly have an opinion, but running it past the folks who live day-to-day in the trenches is pretty important.”

Nor is the final decision on what ends up implemented in the Forcepoint product line. “I do have a seat at that particular table, but there are people who are closer to our customers, who understand what kind of lift these technologies will give for our customers in the real world, not in the lab. I’m happy to share the responsibility because I want the results to be as good as they can be, and I certainly don’t have the only valid viewpoint.”

The company has made it their mission to meet customer needs. Listening to customers telling them how they are using Forcepoint tools ends up teaching them a great deal. “How people wind up using our product is not always as we’d expect. We spend a lot of our time listening and to find out why they didn’t turn on certain features,” Ford explains.

Searching for and fixing customer pain points is one of the things that drive his research. The other is his “sixth sense,” honed by many years in the industry. At the moment, he is focused on researching how users interact with data.

“I think that sooner or later, if you’re a bad guy and you want to steal something, you’re going to have to touch it, albeit electronically. If I understand all those points of contact, it doesn’t matter what the specific threat is. What becomes important is the points of contact with the data – the intersection, if you like, of the network, the data, and the person,” he notes.

“Through that lens, I’m very focused on ‘sense making’ around these contacts, and providing protection at this critical moment in time and space. This is very different than the very threat-centric work I’ve done previously – and which most of the industry is focused on.”

As chief scientist, his aspiration is to make security a non-issue for the users of tomorrow.

“Computing is the most exciting technology that mankind has developed since the wheel, but attackers have corrupted it and used it as a way to harm people. I would love to unleash the power behind computing where people can use it to improve their situation in life, where it really empowers others. I want to change the way we do security, change the approach so we can beat the bad guy, because what we’re doing today is not working,” he says.

Changes in the security landscape

Since his Virus Bulletin days, many of the challenges faced by the information security crowd remained the same, but the scope of the problem became bigger as today we use computers pretty much everywhere. The threat landscape has evolved in that the stakes have gotten higher, and the nature of the attacker is a lot darker, Ford says.

After such a long time in the industry, the most important lessons he learned are these: getting good, usable solutions into the hands of users quickly is extremely important, and actions and technologies that reduce security friction can be just as useful – or even more useful – than things that directly improve detection efficacy.

It is also important to think about security through the lens of “safety.”

“Security has different nuances, but safety is organic: it’s related to how a user actually behaves. I’m not going to change those behaviors dramatically, so I’ve got to think of clever ways to make them safer,” he explains.

“I don’t like to even like to think of us providing security in some ways now, I think of it more of we provide the safety mechanism. We’re like the barrier that you can lean up against, so that you can look up at the Grand Canyon and you don’t fall off the edge. It’s a different way of thinking, but it’s much more human.”

Finally, he’s become very aware that one of the key problems we face is that security solutions are noisy.

“I never have dealt with a breach where I couldn’t find signs of the intrusion when I went back and examined the logs: the fingerprints were there. That tells you that we’re seeing it, but we’re not turning that data into information. To use an analogy, we don’t need more pixels on the screen, we need to make sense of the pixels that we’ve got,” he explains.

“You need to see the big picture – and you do better in terms of security by making sense of the world rather than seeing more of the world. It’s a subtle distinction, but it matters. And that’s one of the reasons why we acquired Red Owl Analytics.”

What should modern CISOs be worried about?

“I think everyone knows the “prepare three envelopes” story, and it kind of feels like that’s the job. You are the crumple zone between the breach and the CEO when everything goes wrong – and it doesn’t matter what the root cause was. I think, for better or for worse, there’s some of that in the role of the modern day CISO,” says Ford.

In the longer term, though, he thinks that modern CISOs will actually either morph into or be placed under the Chief Risk Officer. We’ve already started to see that happening, as CEOs realize it doesn’t matter where risk comes from, be it cyber or physical. He thinks the role will evolve to be broader, and it should: physical security and cyber security should come under the same umbrella, and they very often don’t.

For the CISO, one important point of concern is differentiating between “what’s hot” and “what’s real”.

“Many of my CISO friends spend cycles making sure they have an answer for their CEO regarding some new piece of malware that the current news cycle is talking about. That’s a pity, because these cycles don’t address the real threats to the business. That’s where the experience of a seasoned CISO can really help; they need to be trusted to do their job,” he notes.

“That links nicely to my next point: I think finding the right people to support the CISO in their mission is pretty difficult. Aside from pulling in new talent, the existing talent pool is pretty expensive, and so making the cost make sense to the business is harder. Recruiting and retention; the best thing CISOs can do here is surround themselves with absolutely top-notch cybersecurity products, treat them fairly, and give them room to grow.”


from Help Net Security http://ift.tt/2ipvx1E

Triggered via malicious files, flaws in Cisco WebEx players can lead to RCE

Cisco has plugged six security holes in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files that could be exploited by remote attackers to execute malicious code on a target system.

Cisco WebEx flaws

“The ARF and WRF file formats are used to store WebEx meeting recordings that have been recorded on a WebEx meeting site, or on the computer of an online meeting attendee,” the company explained.

“The Cisco WebEx players are applications that are used to play back WebEx meeting recordings that have been recorded by an online meeting attendee. The player can be automatically installed when the user accesses a recording file that is hosted on a WebEx server.”

Vulnerability exploitation

Exploitation of the vulnerabilities can be triggered via malicious ARF or WRF files. Attackers can send such a file as an attachment, or provide a link to it in an email. In both cases, they have to convince users to download and open the malicious file.

The company made sure to note that the vulnerabilities can’t be triggered by users who are attending a WebEx meeting.

Users of Cisco WebEx Business Suite, Cisco WebEx Meetings, and Cisco WebEx Meeting Server should check whether their installations are vulnerable and implement the provided security updates (if they haven’t by now made sure to receive automatic software updates). Instructions on how to do so are provided in the security advisory.

The good news is that vulnerabilities were discovered and reported by security researchers, and there is currently no indication that they are being exploited in the wild.

But, with their existence having now been made public, attackers could quickly move to create exploits and target businesses, so updating the software to the latest release as soon as possible is advisable.

There are no workarounds for these issues, Cisco added. The only thing left to do if you can’t upgrade is to remove all WebEx software completely from a system.


from Help Net Security http://ift.tt/2ipY8nx

The evil of vanity metrics

vanity metricsWith the fast-paced evolution of tools and connectedness in business operations, the amount of network and log data has exploded. However, organizations have largely failed to adjust their approach to managing and analyzing that growing collection of log data.

Vanity metrics and the tools that produce them, namely the Security Information and Event Management (SIEM) solutions, stand at the forefront of the problem. If we simply measure ourselves with vanity metrics, the collapsing SIEM approach is never seen.

What are vanity metrics and why are they used?

Simply put, today’s vanity metrics are the “number of alerts” and “events per second.” They are easy to generate. Focusing on finding the sources of data and transitioning to a larger database scheme increases the number of events per second and, in turn, the number of alerts. The limit to these metrics is their inability to scale once capacity of the database ingestion is hit.

At that point, searching becomes too slow for analysis to occur. Most SIEMs have changed to a big data backend and have simplified their collection to syslog in order to create more feeds. Besides additions to compliance, a big database is the most common SIEM update.

Vanity metrics create a mess of downstream problems. The processes and techniques supporting a SIEM were never designed for increased amounts of data. Rule-based and reputation-based validation were put in place almost 10 years ago to handle workloads.

It’s not only that SIEMs are outdated, but also how we articulate success. As data has continued to increase, so has the number of alerts that need to be reviewed. Complaints of alert fatigue and skill-staff shortages are a direct result of driving operations with vanity metrics. Success needs to be defined by how these problems are resolved.

Security managers often show success by a funnel graphic, where millions of alerts dwindle down a series of process until there are only a few issues. The success of such a chart is to have a large amount at the top of this funnel, demonstrating a work flow that is addressing millions of potential “issues.” This is a vanity metric, to where a manager shows his worth by talking about how many alerts their organization deals with each day. Leveraging big data and the growth of audited data, any manager can be a rock star with such as chart.

A chart focused on the amount of incoming data misses the point: Are we secure? It is obvious that a scenario of more data without a means to simplify the results is one of information overload. The true metric is accuracy – being able to have the number of alerts to be close to the number of actual incidents without missing any.

However, the abovementioned level of efficiency is difficult. It’s difficult because products have been increasing their false-positive ratio, rule-based validation only slightly reduces the volume of alerts, new behavioral tools lack clarity, and processes are lagging behind technology.

The need to look at technical metrics

The aspects that must be addressed include efficiency, accuracy, time to discovery and time to response. For security operation metrics to be more meaningful in the board room, they need to link themselves to efficiency in terms of time and cost. Metrics need to support the ability for staff to be focused on actual problems, not hunting for them. This means that metrics need to be aimed at the accuracy of determining what events need response, and the speed in which that response can be implemented.

Two metrics give insight into analysis efficiency while determining which events need response: the ratio of incident investigated to actual incidents (or accuracy), and the time it takes until an incident is discovered. If we consider that critical incidents should likely be correct, then accuracy of critical events should be good. The actual accuracy ratio is a 40-to-1. Furthermore, the discovery metric is not so good. The recent Verizon data breach report has the number of days to discover a breach at 140 days. Both metrics show security efficiency is miserable.

Ask any analyst – there are certain alerts that occur so often, they are just ignored regardless of criticality. Statistics show that devices are alerting more often with higher criticality, even though the number of incidents have remained the same. This trend has not been addressed by SIEM vendors.

Tricks, such as threat-reputation validation and rule-based validation do not scale. The fail to provide a means to drastically reduce the overall number of events to review. Moreover, with a rise in advanced persistent threats (APT), reputation validation tends to hide events. By attackers avoiding using bad reputation sites, they can prolong the number of days it takes to discover a breach.

The use of behavioral analytics has not been a silver bullet. Analytics still have a high number of alerts. One vendor’s presentation has a vanity metric of five thousand alerts in a given day. This is the opposite of what we need. Analytics by themselves provide no criticality level. Vendors often use a “template” to help add clarity and provide criticality. In reality, these templates are signatures. A rule-based validation engine matches the signature to the anomaly.

And then there’s the cost: Look at the business metrics

In the end, security operations are part of the business. While technical metrics help us to be more efficient, business metrics are what is understood at the management level. This means to relate the activity of the operations to the effectiveness of the tasks. We have to look at the cost of prevention, the cost of response and the cost of analysis.

For now, we are stuck with spreadsheets to help us track these numbers. By relating the cost of personnel and assets to the metrics of accomplishment, we can determine where an organization is lacking and make plans to address it.

Metrics are hard. Without metrics, we only can guess the impact of our decisions. Organizational maturity is defined by our ability to measure our changes as we try to improve the overall system. What we record greatly impacts our understanding of our success and drives our future goals. Our weakness in security is that we have spent too much time counting the threats and risks instead of measuring our ability to address them.

To move forward, we need to stop focusing on vanity metrics and start to measure what we are trying to accomplish.


from Help Net Security http://ift.tt/2j40eXd

Enterprise security incident response trends to watch in 2018

Resolve Systems shared the top trends to watch in 2018 relating to incident response and automation. The list of predictions are founded on the company’s insight into the challenges enterprises express in today’s new normal of high impact outages/breaches and why companies are investing in incident response and automation technology.

enterprise security incident response trends

“2018 is not going to be a quieter year in terms of cyber-attacks against organizations. We know that threats are becoming more sophisticated and easier for hackers to deploy, in most instances. Therefore, we have to continue to improve our ability to protect against those threats. To do so is a team effort that requires MSSPs, security vendors, SOC managers and all parties involved in incident response to lean on automation technologies and orchestration methodologies that help investigate and remediate attacks quickly, efficiently and in a way that really helps our overworked security teams rather than creating more work for them,” Martin Savitt, CEO at Resolve Systems, told Help Net Security.

Automation acceptance

Businesses’ comfort with security automation will increase due to the necessity for scale. Increasing volume of automated attacks will make it impossible for SOCs to keep up via manual processes alone. Solutions that help hesitant organizations begin to embrace automation (via a crawl/walk/run strategy) will capture increasing market share. This is supported by Forrester Research’s November 9, 2017 report, “Predictions 2018: Automation Alters The Global Workforce.” The report states “Prediction 9: A true combined security and ops automation platform will roll out.”

Lower SOC entry level

Users will increasingly seek solutions that can lower the bar of entry to security teams. Due to security’s significant skills gap, solutions that help less experienced professionals become quickly effective as Level 1 SOC analysts will be increasingly valued.

Continuous response

The market’s focus on incident response will change from today’s reactive position to a continuous one. Post-mortem analysis on security incidents will lead ongoing enhancements and testing for response playbooks. The growing field of “range training” for security team members and red team/blue team simulations indicate that attack rehearsals and playbook tuning will receive increasing attention.

Savvy MSSP shoppers

MSSPs will be affected in 2018 and beyond, as clients begin to request MSSPs to demonstrate attack responses and share metrics on time to respond/remediate for specific incident types. Increasing media coverage and public awareness of security incidents will make for more savvy buyers who want more detailed evidence and assurances of an MSSP’s ability to respond effectively to a significant breach.

SOC as IR thought leader

The SOC team will become a driver for efficiency, automation, and best-practice procedures in IT, Network, and Service Desk, as the remediation activities that these teams perform in security incidents are critical for the success of the SOC. Given this, the SOC may well stand to be the model for all technical teams in an organization.

SIR platform required

Having an incident response platform will become a non-negotiable for security teams. As the rate and scale of cyberattacks will be a forcing function for the adoption of automation, the pain of attempting to automate in a fragmented and piecemeal manner will exert pressure on the SOC to bring in a proper incident response platform to orchestrate and automate response.

More money = more scrutiny

In the wake of recent catastrophic security incidents, CISOs and SOCs will see increasing investment and budget to purchase tools. However, with these added funds will come the onus to demonstrate measurable results and improvements, so teams will seek ways to demonstrate success with analytics, reporting, and attack simulations.

SOC developed automation

As a necessity, many SOCs are already scripting and building out automations to support some simple mundane and repetitive tasks. Leveraging their security expert’s “tribal knowledge”, however, many SOCs will find efficiency in building their own automations and look for tools that lower the programming barrier. They will seek solutions that enable those who know how to investigate and remediate incidents to create automations with no programming skills.

Possible CSIRT resurgence

While the construct of the cybersecurity incident response team (CSIRT) has existed for some time, 2018 will show increased interest in creating these in-house, cross-disciplinary incident response teams. As more and more organizations realize the necessity of enterprise-wide security response, the CSIRT will potentially become a way of attempting to solve cross-team collaboration challenges without having to completely rewire political and technical relationships between Security, IT, Network, and Service Desk.

More movement to MSSPs

MSSPs will receive greater interest from organizations that recognize the level of effort and in-house expertise required for a successful SOC is beyond their means. Smart MSSPs – those that have the right personnel and tools available to build buyer confidence – that demonstrate the ability to meet core enterprise requirements and state-of-the-art responses to security breaches will attract the most interest.


from Help Net Security http://ift.tt/2Ah8koQ

AWS allows customers to manage and protect IoT devices

Amazon Web Services (AWS) announced six significant services and capabilities for connected devices at the edge.

AWS IoT

AWS IoT 1-Click, AWS IoT Device Management, AWS IoT Device Defender, AWS IoT Analytics, Amazon FreeRTOS, and AWS Greengrass ML Inference make getting started with IoT as easy as one click, enable customers to onboard and manage large fleets of devices, audit and enforce consistent security policies, and analyze IoT device data at scale.

Amazon FreeRTOS is an operating system that extends the rich functionality of AWS IoT to devices with very low computing power, such as lightbulbs, smoke detectors, and conveyor belts. And, AWS Greengrass ML Inference is a new capability for AWS Greengrass that allows machine learning models to be deployed directly to devices, where they can run machine learning inference to make decisions quickly, even when devices are not connected to the cloud.

“The explosive growth in the number and diversity of connected devices has led to equally explosive growth in the number and scale of IoT applications. Today, many of the world’s largest IoT implementations run on AWS, and the next phase of IoT is all about scale as we’ll see customers exponentially expand their fleet of connected devices,” said Dirk Didascalou, VP IoT, AWS.

AWS IoT 1-Click

With AWS IoT 1-Click, enabling a device with an AWS Lambda function is as easy as downloading the mobile app, registering and selecting an AWS IoT 1-Click enabled device, and – with a single click – associating an AWS Lambda function.

AWS IoT 1-Click comes with pre-built AWS Lambda code for common actions like sending an SMS or email. Customers can also easily author and upload any other Lambda function.

Managing, securing, and analyzing data

At scale, IoT solutions can grow to billions of connected devices. Today, this requires customers to spend time onboarding and organizing devices, and even more time integrating multiple systems to manage tasks like monitoring, security, auditing, and updates. Building solutions for such tasks is time consuming and easy to get wrong, and integrating third party solutions is complex and may introduce hard-to-detect gaps in security and compliance.

Once a device fleet is operationalized, analytics is often the next challenge customers face. IoT data isn’t the highly structured information that most existing analytics tools are designed to process. Real-world IoT data frequently has significant gaps, corrupted messages, and false readings, resulting in the need for customers to either build custom IoT analytics solutions, or integrate solutions from third parties.

AWS IoT Device Management and AWS IoT Device Defender simplify onboarding, managing, and securing fleets of IoT devices, while AWS IoT Analytics makes it easy to run sophisticated analytics on the data generated by devices.

AWS IoT Device Management (available today) makes it easy to securely onboard, organize, monitor, and remotely manage IoT devices at scale throughout their lifecycle—from initial setup, through software updates, to retirement. Getting started is easy; customers simply log into the AWS IoT Console to register devices, individually or in bulk, and then upload attributes, certificates, and access policies.

AWS IoT Device Defender (coming in the first half of 2018) continuously audits security policies associated with devices to make sure that they aren’t deviating from security best practices, and alerting customers when non-compliant devices are detected. AWS IoT Device Defender also monitors the activities of fleets of devices, identifying abnormal behavior that might indicate a potential security issue. For example, a customer can use AWS IoT Device Defender to define which ports should be open on a device, where the device should connect from, and how much data the device should send or receive. AWS IoT Device Defender then monitors device traffic and alerts customers when anomalies are detected, like traffic from a device to an unknown IP address.

AWS IoT Analytics (available in preview) is a fully managed analytics service that cleans, processes, stores, and analyzes IoT device data at scale. Getting started is easy: customers simply identify the device data they wish to analyze, and they can optionally choose to enrich the device data with IoT-specific metadata, such as device type and location, by using the AWS IoT Device Registry and other public data sources. AWS IoT Analytics also has features for more sophisticated analytics, like statistical inference, enabling customers to understand the performance of devices, predict device failure, and perform time-series analysis.

AWS IoT

Amazon FreeRTOS: Securely connect small, low-power devices to the cloud

Amazon FreeRTOS extends FreeRTOS with software libraries that make it easy to securely connect small, low-power devices to AWS cloud services like AWS IoT Core, or to more powerful edge devices and gateways running AWS Greengrass (a software module that resides inside devices and gives customers the same Lambda programming model as exists within the AWS Cloud).

With Amazon FreeRTOS, developers can easily build devices with common IoT capabilities, including networking, over-the-air software updates, encryption, and certificate handling. Developers can use the Amazon FreeRTOS console to configure and download Amazon FreeRTOS.

Several microcontroller manufacturers and AWS Partner Network (APN) Partners support Amazon FreeRTOS, including Microchip, NXP Semiconductors, STMicroelectronics, Texas Instruments, Arm, IAR, Percepio, and WITTENSTEIN.


from Help Net Security http://ift.tt/2AkhZJo