Dyman Associates Management Japan, EU planning cybersecurity summit

(japantimes) - With China a suspected source of cyberattacks, Prime Minister Shinzo Abe and European Union leaders will agree at a summit in Brussels on May 7 to launch a dialogue to boost cybersecurity, according to a draft of a statement to be issued after the meeting.

“Facing more severe, widespread and globalized risks surrounding cyberspace . . . protection of a safe, open and secure cyberspace is needed,” according to the draft, a copy of which was obtained Sunday.

Abe and the EU leaders, European Council President Herman Van Rompuy and European Commission President Jose Manuel Barroso, will also agree to hold an inaugural meeting of a Japan-EU dialogue on the stable use of outer space in the latter half of this year in Tokyo, the draft says.

Tokyo appears poised to proactively contribute to international rule-making over cyberspace. The launch of a Japan-EU dialogue to promote cooperation on cyberspace would follow similar consultations Japan has held with the United States, Britain and other countries.

In recognition of the threat posed to national security, Japan said in its National Security Strategy adopted in December that it will strengthen information sharing and promote cyberspace defense cooperation with relevant countries.

In the first meeting of the Japan-EU Space Policy Dialogue, the two sides are expected to discuss creation of international norms to reduce space debris caused by anti-satellite tests, satellite collisions and other reasons.

“We affirm the importance of safety, security and sustainability of outer space activities,” the draft statement says.

In 2007, China destroyed one of its aging satellites via a missile-driven anti-satellite test, creating a mess of fragments fluttering through space and sparking concern that such debris could seriously damage other satellites nearby.

In the summit, Abe and the EU leaders will reaffirm their shared view that international disputes and issues “should be resolved peacefully and in accordance with international law, not by force or coercion,” the draft says.

The wording apparently refers to the intrusions by Chinese patrol ships into Japanese waters around the Senkaku Islands in the East China Sea in aimed at undermining Japan’s administration of the islets, claimed as Diaoyu by Beijing and Tiaoyutai by Taiwan.

Turning to Ukraine, the Japanese and EU leaders will “strongly condemn” and “will not recognize” Russia’s annexation of Crimea in March, while urging Moscow and other parties concerned to “refrain from any steps to further destabilize Ukraine,” the draft says.

The leaders will call for ensuring freedom of navigation in and flight over the open seas, according to the draft, in an apparent criticism of China’s unilateral declaration in November of an air defense identification zone overlapping Japanese airspace over the Senkaku Islands.

Beijing announced rules requiring aircraft entering the zone — which covers an extensive area above the high seas separating China, Japan, South Korea and Taiwan — to file flight plans in advance and follow instructions of Chinese controllers or face “defensive emergency measures.”

Policymakers and experts outside China, however, say Beijing is not in line with international norms.

Among other issues, the EU leaders will welcome an expanded role for Japan in promoting and sustaining global peace and security, as set out in Abe’s policy of proactively contributing to peace based on the principle of international cooperation, it says.

Japan will study the possibility of participating in EU peace missions in Africa and elsewhere, it says.

Brussels will be the last leg of Abe’s six-nation European tour starting Tuesday, following visits to Germany, Britain, Portugal, Spain and France.

Dyman Associates Management ISACA launches cyber-security skills programme

(computerweekly) - Global IT association ISACA has launched its Cybersecurity Nexus (CSX) programme to help address the global security skills shortage.

According to the Cisco 2014 Annual Security Report, more than one million positions for security professionals remain unfilled around the world.

CSX is aimed at helping IT professionals with security-related responsibilities to “skill up” and providing support through research, guidance and mentoring.

A recent ISACA survey found that 62% of organisations have not increased security training in 2014, despite 20% of enterprises reporting they have been hit by advanced persistent threats.

“Unless the industry moves now to address the cyber-security skills crisis, threats such as major retail data breaches and the Heartbleed bug will continue to outpace the ability of organisations to defend against them,” said Robert Stroud, ISACA international president-elect.

CSX is designed as a comprehensive programme that provides expert-level cyber-security resources tailored to each stage in a cyber-security professional’s career.

The programme includes career development resources, frameworks, community and research guidance, such as Responding to Targeted Cyberattacks and Transforming Cybersecurity Using COBIT 5.

There is also a Cybersecurity Fundamentals Certificate that is aimed at entry level information security professionals with zero to three years of practitioner experience.

The CSX program marks the first time in its 45-year history that ISACA will offer a security-related certificate.

The certificate is for people just coming out of college and for career-changers now getting into IT security. The foundational level is knowledge-based and covers four domains:

• Cybersecurity architecture principles
• Security of networks, systems, applications and data
• Incident response
• Security implications related to adoption of emerging technologies
• The exam will be offered online and at select ISACA conferences and trainingevents beginning this September.
• The content aligns with the US NICE framework and was developed by a team of about 20 cyber-security professionals from around the world.
• ISACA plans to add more to the CSX programme, including: A cybersecurity practitioner-level certification with the first exam in 2015, Cybersecurity Training courses, SCADA guidance and digital forensics guidance.
• A recent global poll of members of ISACA student chapters shows that 88% of the ISACA student members surveyed say they plan to work in a position that requires some level of cybersecurity knowledge.
• A recent global poll of members of ISACA student chapters shows that 88% of the ISACA student members surveyed say they plan to work in a position that requires some level of cybersecurity knowledge.

However, fewer than half say they will have the adequate skills and knowledge they need to do the job when they graduate.

“Security is always one of the top three items on a CIO’s mind, yet IT and computer science courses at university level are not allocating a proportional amount of training to cybersecurity,” said Eddie Schwartz, chair of ISACA’s Cybersecurity Task Force.

“Today, there is a sizeable gap between formal education and real world needs. This, in itself, is an area requiring immediate focus so that the industry can get better at detecting and mitigating cyber threats,” he said.

According to Tony Hayes, ISACA international president, enterprises cannot rely on just a handful of universities to teach cybersecurity.

“With every employee and endpoint at risk of being exploited by cyber criminals, security is everyone’s business. We need to make cybersecurity education as accessible as possible to the next generation of defenders,” he said.

Dyman Associates Management U.S., UK advise avoiding Internet Explorer until bug fixed

The Microsoft logo is seen at their offices in Bucharest March 20, 2013.
CREDIT: REUTERS/BOGDAN CRISTEL

(Reuters) - The U.S. and UK governments on Monday advised computer users to consider using alternatives to Microsoft Corp's Internet Explorer browser until the company fixes a security flaw that hackers used to launch attacks.

The Internet Explorer bug, disclosed over the weekend, is the first high-profile computer threat to emerge since Microsoft stopped providing security updates for Windows XP earlier this month. That means PCs running the 13-year-old operating system will remain unprotected, even after Microsoft releases updates to defend against it.

The Department of Homeland Security's U.S. Computer Emergency Readiness Team said in an advisory released on Monday that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system.

The recently established UK National Computer Emergency Response Team issued similar advice to British computer users, saying that in addition to considering alternative browsers, they should make sure their antivirus software is current and regularly updated.

Versions 6 to 11 of Internet Explorer dominate desktop browsing, accounting for 55 percent of global market share, according to research firm NetMarketShare.

Boldizsár Bencsáth, assistant professor with Hungary's Laboratory of Cryptography and Systems Security, said the best solution was to use another browser such as Google Inc's Chrome or Mozilla's Firefox.

DELAYED UPGRADES

Security experts have long been warning Windows XP users to upgrade to Windows 7 or 8 before Microsoft stopped supporting it at the beginning of this month.

The threat that emerged over the weekend could be the wakeup call that prompts the estimated 15 to 25 percent of PC users who still use XP to dump those systems.

"Everybody should be moving off of it now. They should have done it months ago," said Jeff Williams, director of security strategy with Dell SecureWorks.

Roger Kay, president of Endpoint Technologies, expects several hundred million people running Windows XP to dump those machines for other devices by the end of the year.

They will be looking at Windows machines as well as Apple Inc's Macs and iPads along with Google's Chrome laptops and Android tablets, he said.

"Not everybody will necessarily go to Windows, but Microsoft has a good chance at getting their business," he said. "It's got to be a good stimulus for the year."

News of the vulnerability surfaced over the weekend. Cybersecurity software maker FireEye Inc warned that a sophisticated group of hackers have been exploiting the bug in a campaign dubbed "Operation Clandestine Fox."

Dyman Associates Management: Project Management

Unpredictability justifies the need for project management. How we prepare for the unpredictable is at the heart of enhancing project implementation — executing projects both in a rapid manner and with superior dependability on the committed targeted dates of delivery.

Usually neglected, the value of project management is vital to a company. Projects render business needs into answers applicable for lasting sustainability and development. Dyman & Associates Risk Management Projects fully realizes the essence of implementing projects promptly and within budget. Our project strategy is founded on Goldratt's Theory of Constraints and guarantees the shortest time for delivering your requirements.

Dyman & Associates Risk Management Projects consultants are not only PMP-qualified; they are likewise knowledgeable professionals with far-reaching technical and management track record. This lets our project managers comprehend project coverage and assure themselves of the soundness of project target dates as well as involve project stakeholders in important dialogs pertaining to excellent performance.

Our most frequently sought after Project Management involvements are:

Remediation Project Management ⇒ A company flops an audit and has a number of issues to resolve. Dyman & Associates Risk Management Projects makes sure all stakeholders stay centered on the objectives (compliance).

Data Center Move ⇒ Transferring infrastructure/applications from one location to another or integrating compound DC within one site. Dyman & Associates Risk Management Projects minimizes the potentials for unmet target dates and downed systems.

Big-scale Technology Resets ⇒ By improving cable plant, desktops, routers,switches, POS, Wide Area Network, etc., Dyman & Associates Risk Management Projects assures that internal & external stakeholders deliver the goods as committed. We do this both for the corporate office and for 2,000 distant offices all over the world.

Dyman Associates Management: Project Management Office (PMO)

A Project Management Office (PMO) is a group or department within a business, agency or enterprise that defines and maintains standards for project management within the organization.

The primary goal of a PMO is to achieve benefits from standardizing and following project management policies, processes and methods. Over time, a PMO generally will become the source for guidance, documentation, and metrics related to the practices involved in managing and implementing projects within the organization. A PMO may also get involved in project-related tasks and follow up on project activities through completion. The office may report on project activities, problems and requirements to executive management as a strategic tool in keeping implementers and decision makers moving toward consistent, business- or mission-focused goals and objectives.

A PMO generally bases its project management principles, practices and processes on some kind of industry standard methodology such as PMBOK (Project Management Body of Knowledge) or PRINCE2 (Project in Controlled Environments). Such approaches are consistent with the requirements related to ISO9000 and to government regulatory requirements such as the US Sarbanes-Oxley (SOX) program.

How a project management office (PMO) is designed and staffed for maximum effectiveness depends on a variety of organizational factors, including targeted goals, traditional strengths and cultural imperatives. There are three basic organizational styles for a project management office.

1.     The project repository: This model occurs most often in organizations that empower distributed, business-centric project ownership, or enterprises with weak central governance. The project office simply serves as a source of information on project methodology and standards. Project managers continue to report to, and are funded by, their respective business areas.

2.     The project coach model: This model assumes a willingness to share some project management practices across business functions and uses the project office to coordinate the communication. Best practices are documented and shared and project performance is monitored actively. The PMO in this model is a permanent structure with staff and has some supervisory responsibility for all projects.

3.     The enterprise project management office: This model also assumes a governance process that involves the project office in all projects, regardless of size, allowing it to assess scope, allocate resources and verify time, budget, risk and impact assumptions before the project is undertaken. Funding is generally a combination of direct, budgeted allocation for baseline services and a fee-for-service charge for others.

Dyman Associates Management: Why mobile security requires a holistic approach

Its remarkable how much can change over the course of just a couple of years. We've seen bring-your-own-device (BYOD) evolve from a buzzword to an accepted practice with a strong business use case. Cyber criminals are savvier than ever and using mobile-optimized techniques and malware to obtain more targeted prizes, such as Social Security numbers and credit card information. Decade-old attacks are even resurfacing under new guises, and with far greater precision than their predecessors. And of course, the proliferation of mobile devices available to an increasingly remote workforce continues to plague IT security professionals who are all too aware of the potential threats.

However, for all the considerable hype around each emerging mobile threat vector, one simple truth remains often overlooked: The only secure way of handling mobile devices is in a managed way. But what exactly does a managed approach look like?

IT security professionals and cyber criminals are continuously battling to gain the upper hand. The trouble is, for the most part, the good guys are being more reactive than proactive. While we are learning from mistakes or flaws in security frameworks as they are breached, cyber criminals are already plotting the next attack, carefully considering areas of  network security that are most susceptible to infiltration. How many more high profile incidents, such as the Adobe or Target hacks, must we endure before going on the offensive? As an industry, it's time to realize that mobile security has been, and continues to be, a systemic problem. Unfortunately, despite myriad expert warnings and sensitive data being put at risk, many mobile technology companies' primary focus remains on the consumer market instead of the enterprise market.

To put it bluntly, endpoints like personal laptops, smartphones or tablets remain the weakest points within a security infrastructure. That's why it's so befuddling how organizations are still permitting unmanaged devices on their corporate networks. With the technical ability of today's cyber criminals, intercepting unencrypted communications, for example, is as simple as taking candy from a baby. While proactive steps to combat threats such as these are clearly necessary, it's important to note that  there is no one magic technology that can efficiently safeguard against every type of malicious situation or attack.

It boils down to this – there is no substitute for fundamentally robust network security components being seamlessly implemented to establish defense in depth. Ideally, this will include everything from client device firewalls to IPsec VPNs. An important caveat to include here is, even these rigorous security mechanisms aren't failsafe against users ignoring common safety precautions, such as blindly clicking on links or opening suspicious e-mail attachments. This means companies should not take for granted that everyone within their organization is equally savvy about basic technology and security protocols—they must continuously educate and reinforce best practices.

Comprehensive solutions are hard to come by, as many security solutions designed to combat mobile threats can, at best, be described as siloed solutions that lack integration between critical security functions and the ability to be managed by IT. To be clear, these solutions do not lack sophistication because, in many cases, they are perfectly functional for the tasks they are designed to perform. Rather, the issue is that threat detection, mitigation and response requires an integrated and managed approach that is often difficult to obtain, considering the way mobile threats are currently tackled. 

For instance, because mobile devices are constantly exposed to different and often hostile public networks, the best security technologies are barely enough to secure a user. Therefore, in the absence of a one-size-fits-all security product – which does not appear to be on the horizon – the best option is to interconnect the range of best-of-breed security products and technologies and have them work together, focusing on providing defense-in-depth rapid threat response. IF-MAP, for example, is an open standard that is well-positioned to deliver in this area. IF-MAP provides the possibility to interconnect different IT security systems for an accurate representation of the health status of an IT network.

All things considered, the problem with mobile devices remains a systemic one. Organizations must be more and more proactive about patching up the holes in their remote access strategies at every stage, from policy creation to the technologies' implementations. IT administrators must reach out across the aisle to everyone, from designers, software architects, company management and end-users, to ensure that the necessary security precautions are being taken, and that corporate compliance is being adhered to. If this collaboration and holistic approach can be accomplished, we are likely to see fewer headlines about major corporate network breaches. Let's make 2014 the year that we take action.

Dyman Associates Management, China on frontlines of cyber security threat

Twenty years after it embraced the internet, China has become a cyber-giant, but a weak one vulnerable to a skyrocketing number of threats.

Since China formally became a member of the global internet club on April 20, 1994, internet users had grown to 618 million at the end of last year, the largest number in the world.

However, due to the lack of technology, experience and strong teams to counter online crime, China finds itself embroiled in cyber security threats from both within and outside the country, especially from the West.

A sign of China's weakness in cyberspace is the fact that China annually imports CMOS chips worth more than US$200 billion, which far exceeds its crude oil imports, according to Deng Zhonghan, a member of the Chinese Academy of Engineering.

Disadvantages in software and hardware for information technology mean the Chinese government and industries are unprepared for cyber espionage. Any sabotage could pose dangers to the country's security and development as well as people's lives and work, experts say.

The situation became more urgent after Edward Snowden, a former US National Security Agency (NSA) contractor, said the US had been hacking into institutions based on the Chinese mainland.

The NSA has also been spying into the servers of Chinese company Huawei's sealed headquarters, according to revelations by The New York Times and Der Spiegel, which the US has not denied.

The spread of online crimes, including the dissemination of rumors and pornography, are also threatening social stability, forcing authorities to enhance campaigns to clean up cyberspace.

To better coordinate internet security and informatization work among different sectors, China has set up a central Internet security and informatization leading group led by President Xi Jinping to turn the nation into an "internet power."

"Without cyber security, there is no national security," Xi warned.

NO BUSINESS IS IMMUNE

China's National Computer Network Emergency Response Technical Team Coordination Center said in its latest annual report that nearly 11 million Chinese PCs were infected last year. Of these, 30 percent of the attacks stemmed from US sources.

About 15,000 computers were hit by Trojan Horse malware and 61,000 websites were targeted with backdoor attacks that originated overseas.

Wang Minghua, the center's operation department director, said threats to China's economic information security are rising as the center settled more than 10,000 cases of phishing websites targeting Chinese banks, a 55% increase compared with that of 2012.

Safety risks could affect internet trade platforms and mobile payment applications and relevant industries as well as consumers' privacy, he said.

Government websites also frequently fall victim to hacker attacks, with more than 600 targeted in 2013.

The official site of the People's Bank of China was hacked on Dec. 19 last year after it curbed bit coin transactions in China, the center said.

Officials said the fundamental reason for China's exposure to the cyber threat is the lack of key technologies, including CPUs, operating systems, databases, high-end servers and telecommunications facilities.

All these core technologies and products have long been monopolized by developed countries, so that the systems of China's government and military departments face severe potential threats of intrusion, said Qiu Shanqin, director in charge of software and integrated circuit sector under the Ministry of Industry and Information Technology.

China's IT market has been dominated by Western giants, including Microsoft, Cisco, IBM, Intel and Apple, while Chinese telecommunications equipment server Huawei has been denied access to the US market for years.

While China itself is a victim of cyber crimes, the country has recently come under frequent criticism from other countries, including the United States, which claimed the Chinese government was behind hacking activities targeting their countries.

Cyber attacks from the United States have been as serious as the accusations from Washington, said CNCERT director Huang Chengqing.

China's Ministry of Foreign Affairs and Ministry of National Defense have refuted the accusations, reiterating China's resolve in combating cyber crimes and calling for the international community to fight hacking.

"CYBER ARMY"

President Xi has called for fostering a "politically firm, professionally competent and morally upright" team to build an "Internet power."

Experts say teams must be good at developing key technologies, including CPU and cloud computing, countering online crimes, and international cooperation.

Huai Jinpeng, an academician of the Chinese Academy of Sciences, said talents in the government, the military and critical IT companies must unite to promote research and bolster information sharing.

Inspiring innovation under favorable government policies is the key to casting off China's excessive dependence on overseas equipment and information systems, he said.

China will also make a law on cyber security this year, according to a legislation plan released by the Standing Committee of the National People's Congress, China's top legislature.

The legislative efforts will help coordinate major sectors to better manage information online, protect key infrastructure facilities and clean up cyberspace, Huai said.