US government released draft for NIST cybersecurity framework

NIST released the draft of cybersecurity framework, which outlines how private companies can protect themselves against cyberattacks, and security breaches.

The National Institute of Standards and Technology has released a draft of the cybersecurity framework for private companies and infrastructure networks as part of  President Obama’s executive order.
The order has the primary goal to improve the network security of the US “critical infrastructure” and it assigns to the National Institute of Standards and Technology the responsibility of developing a framework of best practices for operators in critical sectors of the country  (e.g. Industry, transportation, water and health). The Policy places at the base of the reform process the following three strategic principles:

• Enhance the level of security of national critical infrastructure and their resilience to cyber attacks through the clear assumption of the roles and responsibilities of each governmental entity.
• Encourage and support an effective and efficient exchange of information on cyber threats, the information flow must involve both government and private actors.
• Developing a framework for analysis of data related to cyber threats and occurred incidents for any critical sector of the country, particular attention has to be reserved to emerging risks.

All security reports released by principal security firms reveal the increase in the number of cyber attacks against private companies and critical infrastructures, last May Congress released a survey that claimed power utilities in the U.S. are under “daily” cyber attacks.  It is necessary a strong response from the governments which must also be responsible for the definition of security guidelines.
The NIST has proposed its preliminary cybersecurity framework  with specific intent to respond to the executive order 13636 and create guidelines to improve security for Critical Infrastructure. The adopting of the cybersecurity framework would be voluntary for companies and could help companies mitigate the numerous cyber threats.
The cybersecurity framework draft proposed by NIST was written with the involvement of roughly 3,000 industry and academic experts, it suggests best practices for networks and asset protection to the companies. Another crucial aspect approached by the draft is the guidance on how companies could respond to and recover from breaches. The document also examines how the companies could do all that while protecting privacy and civil liberties.

“Ultimately what we want to do is we want to turn today’s best practices into common and expected practices,” said NIST Director Patrick Gallagher. He also defined the framework “a living document” that is expected to be flexible.
“The framework can be used to help identify and prioritize actions for reducing cybersecurity risk and is a tool for aligning policy, business, and technological approaches to managing that risk.” The draft reads. 

Giving a look to the index of NIST cybersecurity framework it is possible to distinguish the following sections:
Framework Introduction – In this section is provided an overview of the cybersecurity framework that is a risk-based approach composed of three parts:

• The Framework Core is a set of cybersecurity activities and references that are common across critical infrastructure sectors organized around particular outcomes. The Core presents standards and best practices and consists of five functions, Identify,Protect, Detect, Respond and Recover.

• The Framework Profile is the outcomes that a particular system or organization has achieved or is expected to achieve as specified in the Framework.
• The Framework Implementation Tiers describe how cybersecurity risk is managed by an organization.

Framework Basics - this section describes the following NIST Framework Core elements:

• Functions
• Categories
• Subcategories
• Informative References

How to Use the Framework – the section has been written to propose a basic overview of cybersecurity practices to describe how an organization could use the NIST Framework to create a new cybersecurity program or improve an existing cybersecurity program.
The US government has been offering a series of incentives, including cybersecurity insurance and priority consideration for grants, to reward companies that adopt the framework.
NIST will now take public comments for 45 days while the final cybersecurity framework is planned for February 2014.

Dropbox hits back at Zeus phishers

Dropbox has hit back at the hackers behind a recent phishing campaign designed to infect its users with a Zeus-family malware by trying to disrupt their campaign.
The new Zeus campaign was uncovered by cloud security provider Appriver, which reported discovering a bogus password reset email targeting Dropbox customers. The email messages contained a malicious link to a Dropbox file that, when clicked, infects the victim's machine with a Zeus-family malware.
Following its discovery, a Dropbox spokesperson told V3 that the company is aware of the scam and has already investigated and taken action to disrupt the attack.
"This is similar to other email spam campaigns that have spoofed well-known brands to distribute malware. We've investigated and taken action to disrupt this campaign," read the statement.
The spokesperson said users should remain extra vigilant and double check the origin of any email claiming to be from Dropbox before opening it.
"In addition, we urge people to exercise caution with unexpected emails. For example, check the destination of links in emails before clicking on them, verify the email directly with the sender's actual website or support channels, and use up-to-date antivirus software."
At the time of publishing Dropbox had not responded to V3's request for more detail on the specific action it has taken to combat the phishing campaign.
F-Secure security analyst Sean Sullivan said Dropbox was probably trying to flush the malicious files from its systems. "The phishing campaign emails point to Dropbox files, hosted on compromised accounts - or else to accounts set up deliberately by the spammers. I'm sure the Dropbox folks are analysing the IP addresses associated with logins, and are killing other fake accounts set up from the same sources," he said.
"If it looks like the accounts were compromised, their network guys are probably trying to develop some pattern ‘signatures' that would alert them to new phishing-like activity, which would then trigger an account suspension. Outside of that it's a game of whack-a-mole. They could report the phishers' IP addresses to local CERT teams - but there would be little to follow up on as they are almost certainly proxies."
Trend Micro security research vice president Rik Ferguson added that the ability to stop phishing in the first place is almost impossible and that major online firms have to just react as best they can.

"It seems this is just them [Dropbox] saying ‘we've heard that some spam is doing the rounds, abusing the Dropbox brand, distributing malware, don't click it'. To be honest, any company is a victim or a potential victim of this kind of abuse - it's the price of fame," he told V3.
Security firm Kaspersky Lab estimates hackers are hitting the UK with an average of 3,000 phishing messages every day. UK law enforcement has mounted a series of ongoing anti-cyber crime campaigns to help combat the scams. Earlier in October an investigation led by the UK's National Crime Agency resulted in the arrest of a cyber criminal responsible for a £750,000 plot to defraud the financial sector.