CISO , Governance , Risk Management

Computer security companies in Australia may find it harder to recruit following the government's changes to a visa program widely used to fill high skilled technology positions.

See Also: 2017 Predictions on Data Security: Insights on Important Trends in Security for the Banking Industry

Last week, Prime Minister Malcolm Turnbull announced the abolishment of the 457 visa program, which was introduced 20 years ago as part of changes to make the country more internationally competitive. Technology companies are one of the biggest sponsors for 457 visa applications.

The visa intended to help fill jobs for which no native Australians were qualified for and allow freer movement of multinational executives. But critics charge the program has been prone to abuse and deprived qualified Australians of jobs.

As in the U.S., U.K. and Europe, immigration is political hot potato in Australia. A once-fringe political party, One Nation, has gained strength through a racially tinged, anti-immigration platform, which has put pressure on Turnbull's Liberal Party to appear responsive. As a result, the government's press release was seasoned with a dash of populist flare: Putting Australian Workers First.

But some are viewing the government's changes as designed more for political effect than meaningful labor market reforms. About 95,000 people are working under 457 visas, which is less than 1 percent of Australia's 12 million-strong work force.

The Australian Computer Society, the country's largest IT professional group, endorses the changes. In 2014, the ACS contended that immigration data showed the ICT industry was overly relying on 457 visas.

"Skilled migration in all its forms should be a source of competitive advantage for any country, says ACS President Anthony Wong. "It should never be at the expense of the domestic labor market and attracting full workforce participation."

New Visa Class

A new Temporary Skills Shortage visa, which will come into effect in March 2018, is replacing the 457 visa. The TSS is a belt-tightening of some requirements already in place for 457s. But it also arguably makes Australia a less attractive locale overall by reducing the number of people eligible for long-term residency, and eventually, citizenship.

The government removed 200 occupations from 650 that used to be eligible for 457 visas. Most, however, are not IT-related. The new rules also impose stricter English language requirements and require employers make stronger justifications for importing labor.

"These changes are significant and are expected to impact the majority of businesses that currently access the subclass 457 visa program," writes the consulting firm KPMG.

Other changes could affect whether people view Australia as a place to invest part of their working career. A 457 visa allowed people to work in Australia for four years. After two years, employees could apply for permanent residency. Two years later, they could apply for citizenship.

The TSS program creates two new visas. One is valid for two years and the other for four years. The two-year visa has no route to permanent residency or citizenship. When that visa expires, applicants will have to reapply for a four-year visa to get on that path.

Many occupations that could touch on computer security have been moved to the two-year visa, including ICT security specialist and certain kinds of software engineers. And as in many places, capable computer security specialists are notoriously difficult to find in Australia.

Market Distortion

Sydney-based entrepreneur Carlo Minassian, who founded Earthwave, a security operations center specialist firm that he sold to Dimension Data in 2013, says some 70 to 80 percent of the company's specialist employees came from overseas on 457 visas due to a lack of qualified local candidates.

"The [information security] skill does not exist in Australia," says Minassian, who recently launched the security startup LMNTRIX. "Our education system has not grown fast enough to meet the demand of the skills we need today."

The shortage has had the effect of distorting the labor market, Minassian says. Cybersecurity professionals who would only make AU$120,000 (US$95,000) in other places could command AU$200,000 or more in Australia.

"The more rare the skills, the more difficult people are to find and the more competition," he says.

With 457s, employers were, in theory, required to show they will pay the visa holder a market wage. That was intended so employers don't look to overseas for cheaper workers.

But the distorted salaries for information security professionals in Australia makes it hard for companies to justify a lower wage, even if an applicant is willing to take the job. It also puts companies, especially startups, at a competitive disadvantage because they must spend more on labor.

The changes don't bode well for the government's plans to foster a homegrown cybersecurity industry. Last year, the government announced a $230 million cybersecurity strategy, which includes a component to encourage information security startups (see Is Australia Spending Enough on Cybersecurity?).

Adrian Turner, CEO of the Data61 research agency, told InnovationAus: "Generally, Australia needs to make it easier and not harder, for IT and cybersecurity talent to come and work in the country."

A recently uncovered threat group referred to as FIN7 has adopted new phishing techniques and is now using hidden shortcut files (LNK files) to compromise targets, FireEye security researchers reveal.

The financially-motivated threat group has been active since late 2015 and was recently found to have been targeting personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations with a new PowerShell backdoor dubbed POWERSOURCE.

While some security firms refer to the operation as the “Carbanak Group,” FireEye says that not all CARBANAK backdoor activity can be attributed to FIN7. Interestingly, the group’s recent fileless attacks were said last month to have been launched from an attack framework used in various other seemingly unrelated attacks as well.

In the recently observed campaign, FIN7 was no longer using malicious Microsoft Office macros to evade detection, but switched to hidden shortcut files (LNK files) as the initial infection vector, while using the VBScript functionality launched by mshta.exe to infect the victim, FireEye reveals.

The campaign featured spear phishing emails that contained malicious DOCX or RTF files, each being a different variant of the same LNK file and VBScript technique. The group targeted various locations of large restaurant chains, hospitality, and financial service organizations with emails themed as complaints, catering orders, or resumes. On top of that, the group was also calling the targets to make sure they received the email.

The DOCX and RTF files attempt to convince the user to double-click included images. When that happens, the hidden embedded malicious LNK file in the document launches “mshta.exe” with a specific argument. The script in the argument combines all text box contents in the document, executes them, and creates a scheduled task for persistence.

“Overall, this is a more effective phishing tactic since the malicious content is embedded in the document content rather than packaged in the OLE object. By requiring this unique interaction – double-clicking on the image and clicking the “Open” button in the security warning popup – the phishing lure attempts to evade dynamic detection as many sandboxes are not configured to simulate that specific user action,” the researchers note.

A multilayer obfuscated PowerShell script is dropped and launched, which in turn executes shellcode for a Cobalt Strike stager. The shellcode retrieves an additional payload by connecting to a specific command and control (C&C) server using DNS, the researchers discovered. If a successful reply is received from the C&C, the PowerShell executes the embedded Cobalt Strike.

The campaign was also observed using a HALFBAKED backdoor variant, capable of performing various operations based on commands received from the server: send victim machine information (OS, Processor, BIOS and running processes) using WMI queries; take screenshots of victim machine; execute a VB script, EXE file, or PowerShell script; and delete or update a specified file.

One of the LNK files used by FIN7 in this campaign revealed some specific information about the attackers, namely that the shortcut launched within the string data, and that the actor likely generated this file on a VirtualBox system with hostname “andy-pc” on March 21, 2017, the researchers note.

Related: Cybercriminals Target Employees Involved in SEC Filings

Related: Recent Fileless Attacks Linked to Single Framework, Researchers Say

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

The Verizon Data Breach Investigations Report (DBIR) is industry's go-to analysis of security incidents and successful breaches over the previous year. The latest report was published Thursday.

The 2017 DBIR (PDF) marks the report's 10-year anniversary. Over the last decade, it has grown from an analysis of Verizon's own breach data knowledgebase to now include breach data from 65 different organizations. The latest report includes analyses of 42,068 incidents and 1,935 breaches from 84 countries.

Highlights show that the insider threat remains fairly constant as the cause of 25% of breaches, but with 75% being perpetrated by outsiders. The externally-caused breaches, according to Verizon, comprise 51% involving organized crime groups, 18% from state-affiliated actors, 3% comprising multiple parties, and 2% involving partners.

Sixty-two percent of all breaches involved hacking; and 81% of those leveraged either stolen and/or weak passwords. The clear implication is that both organizations and individuals are still, or at least in 2016, were still not exercising adequate password hygiene; that is, strong and regularly changed passwords.

Verizon's figures show that the finance sector is the most frequently breached vertical. Twenty-four percent of breaches affected financial organizations. This was followed by healthcare at 15%; retail and accommodation combined at 15%; and public entities at 12%.

Other key statistics highlighted by Verizon include most of malware is installed via malicious email (66%); an even higher percentage (73%) of breaches are financially motivated; and that 21% were related to cyberespionage.

Verizon hopes that these statistics on recent breaches can help practitioners better protect their organizations today.

"Insights provided in the DBIR are leveling the cybersecurity playing field," said George Fischer, president of Verizon Enterprise Solutions. "Our data is giving governments and organizations the information they need to anticipate cyberattacks and more effectively mitigate cyber-risk. By analyzing data from our own security team and that of other leading security practitioners from around the world, we're able to offer valuable intelligence that can be used to transform an organization's risk profile."

This intent is further aided by a breakdown of methods used to attack the different vertical sectors. For example, the report notes that the accommodation and food services sector "was dominated by POS breaches. Most of them are opportunistic and financially motivated and involve primarily malware and hacking threat actions. Time-to-compromise is quick but time-to-discovery and containment remains in the months category."

One frequently highlighted attack vector is the web application attack, noted particularly in the financial and insurance; information; and retail sectors. "Attackers are always looking for the weakest link in your IT infrastructure, before leveraging expensive 0-days and complicated APT attacks," explains Ilia Kolochenko, CEO of High-Tech Bridge. "Today, the majority of large organizations and governments can be easily breached via their web and mobile (backend) applications."

He adds that this attack vector is still growing with the increasing use of third-party cloud services and applications, "which are exploited by hackers to compromise your trusted third-party and get access to your data afterwards... The report confirms Google's research, which found a 32% increase in website hacking in 2016. Application security becomes a major problem for organizations and should be addressed as a high priority," he suggests.

If there is any weakness in the DBIR as a guide for what to do today, it is that DBIR is an historical analysis of what has already happened in the recent past. For example, the report states that 51% of breaches included malware. On its own, this could persuade organizations to beef up their anti-malware defenses. However, because the analysis looks at past breaches rather than current threats, there is no clear indication of the current growth in non-malware attacks. Anti-malware defenses will not detect such attacks (which typically might use OS apps such as PowerShell) because there is no malware to detect.

Another example could be ransomware. Ransomware is difficult to place in the analysis because it is not a breach within Verizon's definition of breach (actual exfiltration of data), but clearly more than an incident. Furthermore, it is not unusual for infected organizations to decline to disclose the incident -- both of which factors could affect Verizon's statistics. To solve this issue, Verizon used telemetry data from McAFee for its information source. 

McAfee's figures confirmed Verizon's own statistics -- that is, that the incidence of ransomware continues to rise -- but McAfee can provide greater detail. The difference is that McAfee's telemetry provides threat statistics, while the DBIR provides breach statistics. To get a complete view of the current situation, organizations need to consider both recent breaches and currently evolving threats.

Nevertheless, DBIR remains an invaluable resource for security practitioners. "From the beginning, it concludes, "our primary goal was, and still remains, to help organizations understand the threats they are facing, and enable them to make sound evidence-based risk management decisions."

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

The Simple Network Management Protocol (SNMP) embedded in some Internet connected devices allows an attacker to bypass authentication by simply sending random values in specific requests, security researchers have discovered.

SNMP is a popular protocol for network management that features support for three ways to authenticate the client and requests on remote SNMP devices. The first two of these are vulnerable to an authentication bypass if random values are sent in requests, security researchers Ezequiel Fernandez (Argentina) and Bertin Bervis (Costa Rica) argue.

The issue, the researchers say, resides in the manner in which the SNMP agent in different devices (usually cable modems) handles a human-readable string datatype value called “community string” that SNMP version 1 and 2 use.

Called StringBleed and tracked as CVE 2017-5135, the vulnerability is referred to as Incorrect Access Control and could allow an attacker to execute code remotely on the vulnerable device. Successful exploitation would provide them with “full read/write remote permissions using any string/integer value,” the researchers argue.

With the help of a python script meant to build a “snmpget” request that used the sysDescr OID, the researchers started searching the Internet for devices that would respond to the request. The researchers were looking to retrieve the sysDescr OID information successfully when the test string value (admin, root, user, etc) was the same as the one stored in the SNMP agent for authentication.

The script was supposedly going to work as a type of brute force, the researchers say, but the results were surprising, as some of the discovered devices would respond to the request regardless of the used value.

“SNMP version 1 and 2 authentication should only accept the value stored in the SNMP agent authentication mechanism,” the researchers note. However, their testing revealed that an attacker could use any value string or integer to authenticate the SNMP agent successfully on specific device types.

The bug was initially discovered on the CISCO DPC3928SL wireless residential gateway, which is now owned by Technicolor, and which confirmed the bug, but said it was only a “control misconfiguration issue” and that it was isolated to a single Internet Service Provider (ISP).

The researchers, however, claim that the manufacturer is at fault and that the issue is more widespread. According to them, attackers could easily execute code or leak passwords and other sensitive information from vulnerable devices pertaining to several vendors.

In a post on Reddit, one of the researchers revealed that 78 vulnerable models were found to date, and also said that continuous scans might reveal more of them.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

Summer will be here before we know it and for many that means getting off the couch and in shape, but you need a workout program that’s right for you. Boot camp, 20-minute abs, high-intensity interval training, you name it – there are a lot of options. Just make sure you pick one that fits your needs and delivers results or be ready to make a switch.  

The same is true as you move more of your computing environment to the public cloud – you need an approach that’s right for you. In my last article I talked about how much of the IT innovation is happening in the public cloud. To ease the transition and begin to reap the benefits for instance from Software-as-a-Service (SaaS), organizations can use a security framework built specifically for the cloud. There are various frameworks available to help develop your cloud security architecture. The key is finding one that works for your organization and that you can adhere to in order to stay focused on the end goal. 

A framework should be a vehicle for action – a way to structure how you think about the public cloud, breaking the transition down into phases and approaching it in an organized way, but flexible enough to accommodate change. It must help you address questions like: What infrastructure, apps, and data are moving to the public cloud and when? Are the controls we have sufficient and if so how do they translate to the cloud? If they aren’t sufficient, or if shifting to the cloud will introduce gaps in our defenses, what security precautions can we take? As we consume new apps and services from the cloud can we adapt security easily and cost-effectively?

Providers of cloud services are building security into their SaaS offerings which can get you started. But think about the many different ways users will want to use services like Office 365, Google, Box, Dropbox, Salesforce, etc. For example, accessing email and documents from an unmanaged PC, sharing data with third parties, or tracking sales and forecasting which includes sensitive customer information and credit card data. How well do your current cloud services address these use cases and are there gaps?

Not only do you have to consider boosting protection for sanctioned app usage, you also have to contend with shadow IT. Users can easily purchase whatever tools they feel they need to get their jobs done without ever involving the IT organization. Obviously, you can’t protect what you can’t see. What tools are available to protect all the cloud apps in your environment?

According to Gartner, by 2018, the 60% of enterprises that implement appropriate cloud visibility and control tools will experience one-third fewer security failures. Looking at just Office 365 deployments, by 2018, 40% will rely on third-party tools to fill in gaps in security and compliance, which is a major increase from fewer than 10% in 2015.

Enabling different permissions based on users, devices, and policies can typically be done inside each cloud app. But it becomes very cumbersome to manage and even untenable when you have hundreds or thousands of users. You need a simpler way to make sure the right people have the right access to the right data and that the data remains protected. Solutions that allow you to control and discover SaaS apps and protect data usage in the cloud, while enabling employees to get their work done from wherever they are and securely collaborate, must be part of your architecture.

One type of tool to consider is a Cloud Access Security Broker (CASB). This technology was designed to help you stay secure as more users turn to cloud services and access them from within and outside the enterprise. A CASB provides a single pane of glass for management and, through APIs, can connect different parts of your cloud security architecture together so they can work in unison as a cohesive unit. For example, if a user leaves the organization or changes roles, access can be updated automatically across all cloud services. As your company starts to consume and secure more SaaS applications, achieving this level of automation and integration becomes even more critical. Through this single pane of glass a CASB can also monitor your cloud environment to detect and secure sensitive information. It can also discover and control cloud apps connected to your corporate environment so you can reduce the use of risky apps.

However, as is often the case, technology alone won’t address the security gaps you encounter as you transition to the cloud. New skill sets are also required. Since the nature of the cloud is more open and API-focused than most on-prem solutions, you need security staff with knowledge of scripting languages like JSON and Python used to write APIs. An understanding of how to incorporate automation into your security processes is equally important so you can take full advantage of your existing investments in cloud services.

Just like getting off the couch and into shape can be overwhelming, the same can be true for transitioning to the public cloud. But with a structured approach that helps you ask the right questions, and hone in on the right tools and skills you need, you can keep your strategy on track. And, more than that, you can reach the ultimate goal of enabling an ever-mobile and connected workforce and securing them anywhere and anytime. 

Ashley Arbuckle, Cisco’s VP of Security Services, is responsible for the oversight and global delivery of the Cisco portfolio of Advisory, Implementation, and Managed Services, bringing a pragmatic approach to helping Cisco’s clients solve their most complex security challenges. Arbuckle started his career in security consulting at PwC working with Fortune 500 customers. After PwC he joined PepsiCo where he led enterprise security and the strategic planning process for PepsiCo’s IT budget of over $2 billion. He has a BBA in MIS and Accounting from the Rawls College of Business at Texas Tech University, is a CPA, and holds a CISSP and CISM.

Previous Columns by Ashley Arbuckle:

Tags:

Following the success of the “Hack the Pentagon” and “Hack the Army” initiatives, the U.S. Department of Defense announced on Wednesday the launch of the “Hack the Air Force” bug bounty program.

“Hack the Air Force” will be the Pentagon’s largest bug bounty project as it’s open to experts not only from the United States, but also from Five Eyes countries, which includes the United Kingdom, Canada, Australia and New Zealand.

The program, run on the HackerOne platform, aims to help the Air Force strengthen its critical assets. White hat hackers who report vulnerabilities will be eligible for monetary rewards, but the exact amounts have not been specified.

Only vetted researchers can register; military members and government civilians can participate, but they will not earn any rewards.

“This is the first time the AF has opened up our networks to such a broad scrutiny,” said Air Force Chief Information Security Officer Peter Kim. “We have malicious hackers trying to get into our systems every day. It will be nice to have friendly hackers taking a shot and, most importantly, showing us how to improve our cybersecurity and defense posture. The additional participation from our partner nations greatly widens the variety of experience available to find additional unique vulnerabilities.”

Registration for “Hack the Air Force” opens on May 15. The event will take place between May 30 and June 23.

A total of 371 people registered for the previous Hack the Army program. They submitted 416 vulnerability reports, 118 of which were classified as unique and actionable. Participants were awarded roughly $100,000.

Hack the Pentagon received 138 valid submissions and it cost the U.S. government $150,000, half of which went to participants.

Related: Pentagon to Launch More Bug Bounty Programs

Related: HackerOne Offers Free Service to Open Source Projects

Related: HackerOne Penetrates VC Pockets for $40 Million

Eduard Kovacs is an international correspondent for SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags: