86.3 F
Washington D.C.
Sunday, May 26, 2024
Home Blog Page 3223

President Obama’s Cyber Pitch Misses Mark in Silicon Valley

By
Homeland Security Today
-

The Obama administration is stumbling in its cybersecurity message to Silicon Valley, according to tech executives and a former White House official.

Read complete report here.

Nearly 5,000 Illegal Immigrants Absconded or Committed Crimes under ICE’s Supervision

By
Homeland Security Today
-

Although Immigration and Customs Enforcement (ICE) claims few illegal immigrants commit crimes or flee by participating in their alternative to detention program, a recent audit by the Department of Homeland Security (DHS) Inspector General (IG) found ICE lacks the performance metrics to determine whether the program has actually been effective.

ICE’s Intensive Supervision Appearance Program (ISAP) offers an alternative to detention. ICE is responsible for tracking the more than 1.8 million aliens in immigration removal proceedings. However, because ICE’s budget only funds 34,000 detention beds, ICE cannot detain all aliens who are waiting to appear in immigration courts or waiting for removal.

ISAP was created in 2003 to solve this problem. Under the program, ICE supervises aliens it has released from detention, and monitors them electronically. As a condition of release, ICE requires aliens to appear in immigration court for removal proceedings and comply with removal orders from the United States.

ICE claims the program is effective, reporting that the rates at which ISAP participants absconded and were arrested for criminal acts declined each year between 2010 and 2012. However, after changing the program to no longer supervise some participants through their immigration proceedings, ICE never updated its performance metrics.

As a result, ICE did not account for former ISAP program participants who had absconded or were arrested for criminal acts after their participation in the program ended.

According to the IG’s audit report, failure to update the performance metrics has made it impossible to determine “whether transitory participation in ISAP contributes over time to reducing the rate at which aliens abscond or are arrested for criminal acts.”

In reviewing the rate at which individuals in ISAP have absconded or committed criminal acts, the IG discovered 2,010 program participants were arrested for committing crimes between 2010 and 2012. Moreover, during that same period, 2,760 aliens absconded while enrolled in the program — 2010 (927), 2011 (982), and 2012 (851).

The IG determined ICE cannot definitively determine whether “ISAP has reduced the rate at which aliens, who were once in the program but who are no longer participating, have absconded or been arrested for criminal acts.”

In addition, the IG determined ICE does not have sufficient resources to re-detain non-compliant participants who willfully violate ISAP’s terms of supervision. ICE said “dedicating funding for approximately 150 to 200 detention beds nationally, to re-detain program violators as necessary, would discourage willful noncompliance.”

President Obama’s original DHS budget request for Fiscal Year 2015 included a reduction of -3,461 detention beds, or a -10.2 percent reduction to ICE’s detention capacity; as compared to fiscal year 2014 enacted levels. Obama’s FY 2015 DHS budget also called for a -2 percent reduction in ICE’s investigative capacity; a nearly -18 percent reduction of ICE’s transportation capacity; and a reduction of -12 percent to Customs and Border Protection (CBP) Air and Marine Operations, including a more than -30 percent reduction in flight hours.

Beyond these proposed resource reductions, further analysis of Obama’s FY 2015 DHS budget request revealed the following performance impacts, according to the House Committee on Appropriations’ FY 2015 DHS budget report:

  • An inability of ICE to sustain detention capacity, which would prevent ICE from fully complying with statutory mandates to detain criminal immigration law violators and detaining all other aliens in removal proceedings who are likely to abscond or pose threats  to community safety;
  • A significant deterioration of ICE’s capacity to investigate severe transnational crimes, such as illegal weapons exportation, narcotics trafficking, human trafficking and smuggling, intellectual property theft and cyber crime, including child exploitation; and no investigative or financial support to long-standing, authorized programs that address missing and exploited children.

Although ICE developed a Risk Classification Assessment to assist its release and custody classification decisions, the IG determined the “tool is time consuming, resource intensive, and not effective in determining which aliens to release or under whatconditions.”

Moreover, the IG believes the RCA does not improve field office release decisions. For example, of the 228,095 RCA decisions made between July 30, 2012, and December 31, 2013, the RCA made no recommendation for 41,971, or 18.4 percent of cases. In addition, of the 228,095 RCA recommendations between July 30, 2012, and December 31, 2013, ERO officers overrode 49,861, or 21.9 percent of the RCA recommendations.

In turn, the IG recommended ICE revise the RCA tool, as well as develop and implement performance metrics to evaluate ISAP effectiveness. ICE concurred with the recommendations.

Months Later, Hackers Still Inside State Department’s Network

By
Homeland Security Today
-

Three months after the Department of State acknowledged that hackers breached its unclassified email system, government cybersecurity investigators still haven’t been able “to evict them from the department’s network, according to three people familiar with the investigation,” the Wall Street Journal reported Thursday.

The newspaper said that despite the efforts of federal cyber sleuths, outside contractors and the National Security Agency who have repeatedly scanned the State Department’s network and taken some systems offline, “investigators still see signs of the hackers on State Department computers … Each time investigators find a hacker tool and block it … the intruders tweak it slightly to attemptto sneak past defenses,” the newspaper reported.

It hasn’t been disclosed just how much data the hackers have purloined, but unclassified emails and accompanying materials such as attached reports, etc. can still contain sensitive intelligence and other information the State Department would rather not be made public.

Senior counterintelligence and other intelligence officials told Homeland Security Today on background that “a great deal of insight can be gleaned from [the] compromised emails, including following the email threads and identifying other individuals’ emails the hackers might want also want to take a look at,” one of the officials said.

Continuing, the official said the hackers still lurking in the State Department’s network also “might be able to identify [through references] to important activities, reports, intelligence and what not, even though these are notclassified emails. Why, because these are internal emails containing all sorts of correspondence between department officials and personnel.”

“There is the potential that sensitive but not formally classified information is contained in these emails that, from an espionage or foreign policy context, could be extremely valuable – even embarrassing,” another official agreed.

“Given the size and complexity of the State Department, the task at hand becomes even more challenging,” said Darren Hayes, a leading expert in computer forensics and security who has been a consultant on legal cases involving digital evidence. Hayes is assistant professor and director of cybersecurity at Pace University’s Seidenberg School of Computer Science and Information Systems in New York.

“Many successful breaches today are initiated by an employee clicking on a link in an email. Think about how difficult it must be to prevent employees doing this in an organization with thousands of workers,” Hayes said, adding, “The use of unofficial hacker groups by the Russian government is nothing new, and cyber warfare is often the weapon of choice. It is perhaps no coincidence that this breach occurred when US-Russian relations are at an all-time low with broader sanctions looming.”

“When an organization is hacked — especially by a more sophisticated state-sponsored group — it is problematic to determine when their network was breached and the scope of that breach. Moreover, it may take months for an organization to purge themselves of that compromise,” Hayes explained.

“The disclosure that the State Department can’t easily remove a recent malware infestation is an object lesson for all organizations as they scale up – size is a serious problem. Ask any public health official – to quarantine one house is easy enough, but to root out a disease across a city is far harder," said Dr. Mike Lloyd, CTO at RedSeal, a security analytics company.

"The Department of State has special pressures, since embassies operate in almost every country in the world, but any large company suffers similar problems. Many modern attacks start by fooling a human – well-crafted phishing attacks are the new normal. But compromising one laptop doesn’t generally get the attacker what they want, so they move laterally, looking for a solid hand-hold beyond the initial toe-hold," Lloyd said.

"In fast-moving, modern infrastructure," Lloyd continued, "there is always a weakest server for them to find, and attackers can search for whatever is maintained the least well. This fan-out creates real headaches for defenders, even after a breach is confirmed. The only practical response is to map out weaknesses ahead of a breach – to know where the pockets of infection are likely to be, so that you can efficiently root them out.”

‘Patriot Hackers’ Claim to Fight Cyber War Against Terrorists

By
Homeland Security Today
-

There’s a new group of soldiers in the cyber war against terrorism. They operate online, on their own and follow a unique set of rules.

They call themselves patriotic hackers. They claim they are doing what the Government does not do—taking down terrorist-run websites that recruit Westerners and support Jihadi propaganda.

Read complete report here.

DHS Stalemate Leaves Local Governments Hanging

By
Homeland Security Today
-

If all politics is truly local, the big sleeper in Washington’s fight over the Homeland Security budget could be the city and county agencies that depend on the same bill to help finance their emergency response teams.

Read complete report here.

Obama Says World Should Address ‘Grievances’ Terrorists Exploit

By
Homeland Security Today
-

President Obama defended his administration’s approach to the terror threat at a White House summit Wednesday, standing by claims that groups like the Islamic State do not represent Islam — as well as assertions that job creation could help combat extremism.

Obama, addressing the Washington audience on the second day of the summit, said the international community needs to address “grievances” that terrorists exploit, including economic and political issues.

Read complete report here.

Danish Government Pledges Millions to Fight Terrorism

By
Homeland Security Today
-

Denmark’s government on Thursday pledged 970 million kroner ($130 million) to strengthen anti-terrorism measures, after two people were killed and five wounded in shootings at a free speech event and a synagogue in Copenhagen over the weekend.

Read complete report here.

Hacking The Human OS

By
Homeland Security Today
-
In a new report, Hacking the Human OS, Intel security researchers Raj Samani and Charles McFarland found that, increasingly, hackers are using social engineering techniques to manipulate their victims and coerce them into making poor decisions. This is effective in government agencies as well as private sector businesses.

Intel describes social engineering as the deliberate application of deceitful techniques designed to manipulate someone into divulging information or performing actions that may result in the release of that information.

The report found:

Two-thirds of the world’s email is now spam aiming to extort information and money.

  • A sharp increase of malicious phishing emails has resulted in more than 30 million suspect URLs recorded by McAfee Labs;
  • 20 percent of attacks involve hackers using seemingly benign, bogus websites to deliver vicious malware into their targets; and
  • Bogus emails are another effective form of social engineering, as 18 percent of users will unwittingly click a link in a phishing email.

In July 2014, more than 1,000 energy companies in North America and Europe were reported to have been compromised by targeted cyber attacks.

Compared with other targeted attack campaigns (such as Operation Troy, Operation High Roller and Night Dragon), this effort appears different in almost every way. However, the one common theme among all of these is social engineering. Whether the target of the attack is a consumer. or an employee in a large enterprise, the modus operandi for most cyber criminals is to employ some form of social engineering to coerce the victim into an action that facilitates the infection.

The types of malicious actors involved in cybercrime, any of whom may leverage social engineering as an attack vector, vary. The Center for Internet Security cited the following:

Script kiddies: Unskilled hackers who use simple techniques.

Insiders: Although they may not have strong technical skills, their access to sensitive networks represents a risk.

Hacktivists: Agents of hacktivism, which combines politics, the Internet, and other elements.

Lone hackers: Their skills or motivations will vary.

Organized cybercriminals: Criminal syndicates formed to conduct cyber crime.

Nation-state hackers: These actors pose the highest, consistent cyber threat to state and territorial governments, and an unknown level of risk to local and tribal governments.

Terrorist groups: The Center for Internet Security notes that skilled hackers within these groups are rare but will likely become more significant within the next one to three years as they gain a broader skill set.

The Intel report stated many organizations develop a user awareness program, but that the effectiveness of such programs varies. It used an example of an ineffective training campaign from the United States Military Academy at West Point. Cadets at West Point receive security awareness training. The freshmen spend four hours (four lessons) learning about information assurance and network security.

There is a culture at West Point that any email with a “COL” (abbreviation for colonel) salutation has an action to be executed. So, a bogus email message informed cadets of a problem with their current grade report and instructed them to click on an embedded hyperlink to make sure their grade report information was correct. Even with four hours of computer security instruction, 90 percent of the freshmen clicked on the embedded link.

The researchers said an awareness program that is combined with measures to evaluate its effectiveness is one of the best tools for fighting social engineering attacks. Although continuous measurement and refinement in education programs represent an effective counter against social engineering, they are rarely used. In fact, many organizations have not implemented any sort of security or policy awareness training for their employees. A recent study by the Enterprise Management Associates (EMA) found that 56 percent of employees had not gone through such training.

Intel recommended the following controls to mitigate the risk of social engineering. These are divided into three categories: people, process and technology. Intel pointed out that these controls are not exhaustive, and may not be applicable to all organizations.

People

Provide clear boundaries: All staff should be keenly aware of the policies regarding the release of information and have clear escalation paths should a request fall outside of their boundaries.

Ongoing education: Implement a security awareness program to consistently educate employees over time. Use tools such as the McAfee Phishing Quiz to highlight specific tactics commonly used in attacks.

Permission to verify: Provide staff with the confidence to challenge even seemingly innocuous requests. An example of this is to challenge people when attempting to tailgate into offices.

Teach the importance of information: Even seemingly innocuous information such as telephone numbers (enabling information) can be used to stage an attack.

Create a no-blame culture: The targets of social engineers are victims. Punishing specific employees who have been deceived will make all staff less likely to admit to releasing information. Once conned, they could come under the control of the social engineer, who can then use blackmail.

Process

Bogus call reports: When a suspicious activity has occurred, staff should complete a report that details the interaction. This assists investigations.

Informative block pages: When employees reach a malicious web page, use a block page to inform them why they cannot proceed. This will cause them to reflect on their prior action and can help identify sources of attack.

Customer notification: When callers are denied information, the organization should notify them and verify whether the caller was entitled to the information. Organizations should also consider how they communicate with customers.

Escalation route: A clear reporting line for front-line staff to escalate any doubts they may have about interacting with potentially fraudulent messages.

Tiger testing: Routinely test staff for their susceptibility to social engineering attacks over the use of multiple communication channels.

Technology

Call recording: Routinely record incoming telephone calls (while following federal and state wiretapping laws) to assist investigations.

Bogus lines: Route calls that are believed to be suspicious to a monitored number.

Email filtering: Remove fraudulent emails containing known and never-before seen malware.

Web filtering: Block access to malicious websites and detect malware inline with access to the Internet.

Strong authentication: Although leveraging multifactor authentication will not eliminate the risk of users being socially engineered into giving up their authentication credentials, it will make the task more difficult for would-be attackers.

“The threat of social engineering is very real,” Samani and McFarland said. “Cyber criminals use it to unlawfully extract information for various malicious uses. To best counter the problem, we must understand the nature of social engineering attacks. This means defining the likely threat actors, their attack methods, and their resources—and applying the relevant controls to reduce the risk ofa successful attack.”

New Malware Cybersecurity Technology Licensed by DHS S&T

By
Homeland Security Today
-

New malware detection technology from the Department of Homeland Security (DHS) Science and Technology Directorate’s (S&T) Cyber Security Division Transition to Practice (TTP) program has been licensed for market commercialization.

DHS announced Thursday that, “This is S&T’s second technology that has successfully gone through the program to the commercial market. The technology, Hyperion, developed by Oak Ridge National Laboratory, is a malware forensics detection and software assurance technology that has been licensed to R&K Cyber Solutions LLC, a Manassas, Va. based application development and cyber solution company.

“The best technology ideas remain just ideasuntil they can be commercialized and put to use,” said DHS Under Secretary for Science and Technology Dr. Reginald Brothers. “I am proud that S&T’s Transition-to-Practice program has facilitated getting another outstanding research project out of the lab and into the marketplace.”

In 2012, DHS said, the TTP program identified Hyperion as a promising candidate for further development and transition to the commercial marketplace. By calculating the behavior of software, the Hyperion technology has the ability to detect malware. Through the TTP program, Hyperion was introduced to private industry partners, and quickly generated interest from R&K to make the technology commercially available.

Established in 2012 as part of S&T’s Cybersecurity Division in an effort to support the Department’s mission of improving the nation’s cybersecurity capabilities, the TTP program looks to transition federally funded cybersecurity technologies from the laboratory to consumers. The program, led by S&T’s Michael Pozmantier, also seeks to create institutional relationships between the cyber research community, investors, end users and information technology companies.

“Last year,” DHS said, “S&T announced the first technology, the Quantum Secured Communication, which transitioned to the commercial market through the TTP program, two years ahead of schedule. The Quantum Secured Communication is an encryption system used to protect the nation’s critical cyber infrastructure.”

DHS said, “Each year, the TTP program selects a handful of promising cyber technologies to incorporate into its 36-month program. S&T introduces these technologies to end users around the country with the end goal of transitioning them to investors, developers or manufacturers that can advance them and turn them into commercially viable products.”

“Throughout the year,” DHS continued, “S&T will host events around the country to showcase the technologies for companies from the energy, financial, and the government sectors in order to develop pilot opportunities, and to turn these into commercially available products. The next TTP technology demonstration event, TTP Investors, Integrators and IT companies – West, will be held in Silicon Valley on May 19, 2015.

Currently, the TTP program has 24 technologies (eight from fiscal year 2013, nine from 2014 and seven from 2015) that are ready for transition to the marketplace.

“With the success of the Hyperion technology transition, S&T hopes commercial technology partners and end users will take notice of other technologies, not only in the TTP program, but in the entire government R&D community, as solutions to complex problems,” DHS said in its announcement.

For more information, visit scitech.dhs.gov/cyber-research, view the TTP project video  or email [email protected].

Better the Devil You Know? Jihadism Without Al Zawahiri

By
Homeland Security Today
-

The enthusiastic celebrations in America surrounding the death of Osama Bin Laden at the hands of Seal Team Six on May 2, 2011 were entirely understandable. The President’s dramatic announcement in the early hours that morning added to the sense of the achievement and occasion. Despite evading justice for nearly a decade, the White House finally got its prize target.

In the aftermath, however, a number of key commentators were quick to join in on the wave of euphoria and claim, albeit in somewhat guarded words, that the end of Al Qaeda was in sight. The loss of its leader did create a hiatus. Al Qaeda’s franchises were unsure of the leadership credentials of Bin Laden’s natural successor Dr. Ayman Al Zawahiri.

While Al Zawahiri was the source of the theological inspiration behind Al Qaeda’s actions, he had little operational experience. The lack of attacks by Al Qaeda in the West since the death of Bin Laden seemed to back up that hypothesis. But what was going on was far more complex. The hierarchical structure that had served Bin Laden so well started to morph into a federated relationship structure. And this was always likely to have its problems as Al Qaeda franchises and jihadi groups vied for position.

It seemed to some caught up in the moment that the end of the so-called “War on Terror” could be imminent. Sadly, though, such prophesies have proven to be a false dawn. As the attacks in Paris just before Christmas dramatically revealed, Al Qaeda and its franchise in Yemen – Al Qaeda in the Arabian Peninsula (AQAP) – still retain the ability to launch attacks on the West.

The attack in Paris gave Al Qaeda’sleadership a much needed boost. Its lack of any significant headline attacks in the West since events in Madrid and London in 2004 and 2005 saw the jihadi group losing support. Some of its acolytes were clearly beginning to lose patience with the hierarchy, and reports emerged across North Africa that some franchises were deserting the brand of Al Qaeda to join the Islamic State of Iraq and the Levant (ISIL) –provide additional evidence of a state of unease in Al Qaeda’s support base.

These claims may turn out to have been exaggerated. While some previously loyal groups have declared their support for ISIL, this has not turned into a tidal wave. Al Qaeda remains a significant player on the international stage, even if its ability to direct operations is severely constrained.

Yet, that situation does not mean all is well for Al Qaeda. The operations conducted in its traditional sanctuary in North Waziristan by the Pakistani Army have restricted its room for maneuver. Rumors that its leadership have hadto move to Kumar Province continue to circulate and Al Zawahiri appears to be an isolated and marginalized figure. This may be indicative of the fact that he has yet to establish a new base from which to operate.

While the ever loyal AQAP stated the order for the Paris attacks came from the very top of the Al Qaeda organization — and implication that Al Zawahiri personally authorized the attacks — he has yet to substantiate that claim. AQAP’s leadership certainly understands the significance of their words in trying to prevent any hemorrhaging of support to ISIL. However, this messaging hides a much deeper malaise within Al Qaeda. Past supporters are now openly questioning the leadership of Al Zawahiri.

Doubts about his leadership style have recently re-surfaced in jihadi forums. Doubts initially appeared following Bin Laden’s death, but today there’s been much more vocal discontent over which Al Zawahiri should be replaced by Nasir Al Wuhayshi, the Yemeni citizen who leads AQAP.

Such suggestions have their merit from an operational viewpoint. AQAP clearly enjoys a great deal of maneuver room in Yemen as a direct result of the increasing instability in that country. It also has shown it can use that freedom to its advantage, as its attack on the satirical magazine Charlie Hebdo showed. Fears that Yemen could become the vanguard of yet more attacks on the West have some justification, but imagine how that dynamic would change if Al Qaeda and ISIL were to be reconciled.

Al Wuhayshi leads the one Al Qaeda franchise that looks outwardly towards the West as well as conducting operations to destabilize Yemen. AQAP’s past track record of using novel developments in chemical explosives and trying to attack airliners also has to be kept in mind. So, in many ways, it’s understandable that Al Wuhayshi he is seen by many Al Qaeda acolytes to be a better leader than Al Zawahiri.

Role-reversal, however, does not seem to be compatible with the ego of Al Zawahiri. Having been bestowed the mantle of leadership of Al Qaeda, he isn’t about to give it up. His attempts to reign in ISIL leader Abu Bakr Al Baghdadi over Al Baghdadi’s move into Syria created a legacy of distrust that makes a collaboration or subservience to the self-proclaim leader of the new Caliphate an unlikely outcome. The open sores between Al Qaeda and ISIL date back to Al Zawahiri’s attempts to reign in Abu Bakr Al Baghdadi’s predecessor, Abu Musab Al Zarqawi at the height of the insurgency in Iraq. This history between the two players is a major hurdle to any reconciliation that unites the groups, which, if it occurs, would radically change the threat dynamic.

It would seem the only way those commenting on jihadi forums about Al Zawahiri’s replacement would get their wish is if the White House gets a bead on his whereabouts and decides to kill or capture him. Such a decision would have profound consequences.

One possible trajectory for the evolution of the international Islamic terrorist movement in a post-Al Zawahiri world is a rapprochement between Al Qaeda and ISIL. Such a move would be greatly facilitated by the removal of Al Zawahiri. In his recent report in Homeland Security Today, If Jihadi Groups Form Alliances, Threat to West Will be Unprecedented, Contributing Writer Godfrey Gardner argued that in the background “alliances are already forming.” Should Al Zawahiri be removed, this might add a dramatic catalyst to the rate at which such realignment occurs. Gardner made the point that if Al Qaeda and ISIL were to be reconciled, the West would be facing a “radically empowered enemy,” His analysis is clearly not a work of fiction.

[Editor’s note: Also see Garner’s report, The Potential that Jihadi Groups will Unify … and With it, More Savagery]

The conflagration of ISIL and Al Qaeda would combine the long-term, deliberate planning approach of Al Qaeda with the more spontaneously generated lone wolf attacks that currently characterize the ISIL threat to Western societies. Such a merger under the leadership of Al Baghdadi would provide another boost to his claim to be re-creating the caliphate. It also would provide a major potential boost to recruitment into the emerging organization.

While some Al Qaeda franchises may choose to try and remain isolated from ISIL, it is more likely they would quickly fall into line. Any momentum recently lost by ISIL as a result of the tepid bombing campaign being conducted by the West against it would be quickly reversed – amidst an overall deteriorating Middle East.

Such a scenario is possible. The Obama administration should therefore approach any opportunity to capture or kill Al Zawahiri with extreme care. Sometimes it’s better to deal with the devil you know.

Dr. Dave Sloggett has more than 40 years’ experience analyzing international security issues. His most recent books are, Focus on the Taliban, and, Drone Warfare. His article, Kenyan Fault Lines: An Unstable Divide Ideal for Terrorist Exploitation, appeared in the June/July, 2014 Homeland Security Today. He also recently wrote, The End of Al Qaeda — and the Emergence of a More Dangerous Jihad?

1...3,2223,2233,224...3,251Page 3,223 of 3,251
All content copyright ©2024 Homeland Security Today. All rights reserved.

POWERED BY MHA Visuals