ShotSpotter creates mobile app to bolster situational awareness, improve safety

NEWARK, CA Sept. 20, 2016 SST, Inc., the global leader in acoustic gunfire detection, today announced a new mobile app designed to extend ShotSpotter Flex alerts to a new native browser user-interface and native mobile iOS and Android platforms. With the new mobile app, more law enforcement users will have access to the valuable ShotSpotter service beyond the dispatch office or squad car, with real-time gunfire alerts delivered anytime, anywhere on any iOS or Android mobile phone, tablet or desktop. The new mobile app is designed to provide timely situational awareness information to speed up officer response time and improve safety.

Mobile App Now Available

The ShotSpotter mobile app – now available for download – makes it very easy for all law enforcement personnel to directly receive instant alerts on their mobile devices. These always on push notifications of gunshot incidents are instantly sent to a user’s mobile device in real-time so that department personnel never miss an alert – no matter where they are or what they are doing. Each ShotSpotter alert provides key information for each incident including: incident time, number of rounds, and the location with a highlighted evidence search area. In addition, officers can play the audio of the gunfire incident in order to have full situational intelligence on the event they are responding to. In order to aid in officer safety while on the beat, the app information is displayed via a low light user interface.

“The ShotSpotter mobile app delivers a world class mobile experience designed specifically to keep officers safe and informed wherever their job takes them,” said Ralph A. Clark, CEO of SST. “Going mobile provides broader reach and deeper engagement to critical real time gunfire data that law enforcement needs to address violent crime quickly and effectively. Our mobility initiative has been inspired and informed by key user and market feedback.”

South Bend PD Touts Ease of Use

The South Bend Police Department in Indiana is a longstanding user of ShotSpotter and has been beta testing the mobile app for several months. Approximately ten department personnel in varying positions are currently using the mobile app.

“The ShotSpotter mobile app has helped us to be more proactive in responding to gunfire incidents because we get the information we need quickly and can decide the best way to respond,” said Captain Tony Bontrager. “The app is very straightforward and easy to use and lets us know the address and how many shots are fired. We get the information live - anywhere, anytime - without having to exclusively rely on dispatch to call us or take the time to log on to a system.”

Minimal IT Involvement Required

The mobile app works exclusively with the ShotSpotter Flex solution and is offered as a free download through the Apple app store and Google Play. The mobile alerts do not require out of browser (OOB) applications to view and access, and are available on iPhones, iPads, Android devices, laptop computers and desktop computers. The download and set up process is easy for new users and requires minimal IT involvement or overhead for agencies.

Using the Amazon Web Services Cloud

To deliver increased scale, high availability, and disaster recovery, the company chose Amazon Web Services (AWS) – a leader in commercial cloud – to host the back end infrastructure for its mobile and browser apps. SST has been able to invest in feature innovation instead of infrastructure management. AWS allows SST to scale servers capacity automatically on demand and maintain high performance, all while keeping costs down.

About SST, Inc.

For more information visit the ShotSpotter mobile app datasheet. 

Source Government Security News

KrebsOnSecurity moves to Project Shield for protection against DDoS attack censorship

Security journalist Brian Krebs turned to Project Shield for free protection against DDoS attacks that are being used as a form of censorship

Unless you are a bad guy intent upon nefarious schemes to exploit technology in order to make money, you probably have a great amount of respect for security reporter Brian Krebs. The crimes, breaches and attacks he has exposed have been so stunning that it boggles the mind. If cyber thugs have a “most wanted” list, then Krebs is likely at, or very near, the top.

Yet what kind of messed up world do we live in if criminals can exploit horribly insecure Internet of Things devices with such success that it can silence the voice of a journalist like Krebs?

Krebs most recently ticked off allies of vDOS; he wrote about the DDoS-for-hire company, and the two teenagers allegedly behind it were arrested. Although it’s nothing new for his site,KrebsOnSecurity, to come under attack, like it did after his vDOS exposé, nearly two weeks later, Krebs’ site was hit “with the largest DDoS the internet has ever seen. 665 Gbps” (gigabits per second). Some of the POST request attacks included the string “freeapplej4ck,” referring to one of the alleged teenage owners of vDOS.

His site has been protected by Prolexic, which was acquired by Akamai. Yet after sustained attacks were hitting his site with about 620 Gbps of junk data, Akamai opted to stop providing Krebs with pro bono protection service; protecting his site was affecting the company’s paying customers.

Akamai, which Krebs does not fault for dropping him, claimed a sustained DDoS attack against Krebs’ site could have cost millions of dollars to mitigate. Akamai told The Boston Globe that the scale of attack on Krebs “stunned its engineers” because it was “almost twice as much traffic as Akamai had ever seen in a previous attack.”

Dropped like a hot potato, given only a two-hour heads-up that Akamai would no longer protect his site for free, Krebs needed a new solution for the massive DDoS attacks crippling his site. Oh sure, he was offered DDoS mitigation, but the same level of protection he had under Akamai would cost him a jaw-dropping $150,000 to $200,000 annually. That’s hardly a sum any independent journalist could scrounge up by digging for pocket change in their couch. Krebs said, “Ask yourself how many independent journalists could possibly afford that kind of protection money.”

“Free speech in the age of the internet is not really free,” Krebs told Ars Technica. “We're long overdue to treat this threat with a lot more urgency. Unfortunately, I just don't see that happening right now.”

Yet Krebs needed to bring his site back up, so he opted for Project Shield, which offers “free, unlimited protection.” The service is built on Google Cloud Platform in order “to protect news sites and free expression from DDoS attacks on the web.”

The free service claims:

No matter the size of your website or the size of the attack, Project Shield provides free protection for news, journalist, human rights, and elections monitoring sites.

Project Shield

In “The Democratization of Censorship,” the first post since Akamai dropped him and his site was down for days, Krebs wrote, “Why do I speak of DDoS attacks as a form of censorship? Quite simply because the economics of mitigating large-scale DDoS attacks do not bode well for protecting the individual user, to say nothing of independent journalists.”

Krebs was not the only one under heavy attack via botnets exploiting compromised IoT devices last week, but he doesn’t believe nation state actors are the ones learning to take down the internet.

Regarding the massive attack responsible for the latest chaos and upheaval pointed his way, Krebs said the botnet of IoT devices include “routers, IP cameras and digital video recorders (DVRs) that are exposed to the internet and protected with weak or hard-coded passwords.” Most can be purchased for fewer than $100 and, for right now, “criminals at the helm of these huge DDoS crime machines are content to use them to launch petty, yet costly, attacks against targets that suit their interests or whims.”

DDoS attacks leveraging millions of insecure-by-design IoT devices will only get worse, and something needs to be done “to address this growing threat to free speech and ecommerce.”

Krebs added:

But what we’re allowing by our inaction is for individual actors to build the instrumentality of tyranny. And to be clear, these weapons can be wielded by anyone—with any motivation—who’s willing to expend a modicum of time and effort to learn the most basic principles of its operation.

The sad truth these days is that it’s a lot easier to censor the digital media on the internet than it is to censor printed books and newspapers in the physical world. On the internet, anyone with an axe to grind and the willingness to learn a bit about the technology can become an instant, self-appointed global censor.

By Ms. Smith

How Blockchain Fits into the Future of Digital Identity

"When you already have a wheel, you can make a wheelbarrow, or a car. People are discovering any number of ways" to use blockchain, says Suresh Ramamurthi, the chairman and chief technology officer of CBW Bank.

 Enlarge This Image

The Future of Digital Identity Is Up to Banks

Why Barclays Sees Banking's Future as an Information Business

Do Banks Have a Practical Use for the Blockchain? The Debate

Could blockchain be the backbone of a universal digital identity system?

Innovative banks are increasingly seeing their future as the stewards of identity — they would serve as the authenticators. Such a system would allow consumers to use a digital token to verify their age when ordering a beer or to log on to an e-commerce site.

But several blockchain companies are looking to play a vital role in the future of identity. In theory, blockchain technology enables entities independent of each other to rely on the same shared, secure and auditable source of information in a way that fits well with a system of widespread digital identity.

Gem, a startup in Venice, Calif., is focused on getting companies within the same industry to share information via blockchain technology. For banks, one possible solution would be in know-your-customer compliance — bank users would be able to vet a customer by relying on the work another bank has already done. Another is London-based Credits.Vision, which is looking to create a blockchain of blockchains, connecting various permissioned and public systems so that a digital identity could be truly universal.

As banks plot their future in identity, many may look to partner with blockchain companies also eyeing the space. Suresh Ramamurthi, the chairman and chief technology officer of CBW Bank in Weir, Kan., sees digital identity as a practical use for blockchain. His bank, like many others, has been seriously investigating the possibilities of the blockchain. For instance, it has partnered with the distributed ledger firm Ripple for instantaneous cross-border transactions.

"We have the basic technology," he said, referring to blockchain. "When you already have a wheel, you can make a wheelbarrow, or a car. People are discovering any number of ways" to use the blockchain.

He also sees it as a potential accelerant and enabler for the adoption of a digital identity system.

"The technology is not very complicated; this is something we could do now," Ramamurthi said of a universal digital identity. "Banks already have to verify identity for KYC; expanding that across the Internet is not a very big leap."

As Micah Winkelspecht, chief executive and founder of Gem, sees it, banks' role in digital identities would be to serve as authenticators.

"Rather than the banks being in control, should the customer be in control of certain information they could then passport around?" he asked. "There's a good argument to be made for both sides. But banks certainly could act as a certifying body for individual identity on the blockchain."

Using a distributed ledger system would also allow people to retain authority over their identity, Winkelspecht says.

"With blockchain you have the same conveniences of a centralized ID authority but without having to turn over power to a third party."

But in that scenario, banks would still benefit, he said. Today, every time a consumer goes to a new bank for services they are KYC-vetted, even though one bank has already verified them as a customer, he said, adding that this problem is multiplied at large banking institutions where a customer must get verified for KYC compliance over and over again within different departments.

Gem argues that if a group of banks shared a KYC blockchain, institutions could cut costs on KYC collection software. With a shared ledger system built on public key cryptography, banks could authenticate the consumer, and certificates attached to that key could authorize the consumer for certain functions, he said. Besides banking, Gem is partnering with industries like health care on creating blockchain networks to establish trust and transparency and share information between organizations.

Like Gem, Credits.Vision sees creating a better way for banks to share information as an important step in creating a federated digital identity, said Nick Williamson, its chief executive.

The firm is working on creating a blockchain that would connect other blockchains, both private ones being tested by banks and public ones like the bitcoin blockchain. One function of this project could be used for identity, where a consumer could upload their personal details (in encrypted form) once, whether with a bank, passport office, or telecom provider and the identity could then be used in any other context.

Williamson sees the real potential of blockchain technology as a next-generation, open and interoperable form of public key infrastructure. PKI was developed in the 1970s to secure communications — Bob encrypts a message to Alice with her public key, and only she (or someone who has her private key) can decrypt it. In theory, it's a great way to manage identity, since a message signed with Alice's private key could only have come from her (assuming the key hasn't been compromised). But it's never caught on as a mass-market technology.

"Key distribution has always been a gigantic pain point preventing widespread adoption of consumer-focused PKI," Williamson said. Combining blockchain with PKI could address adoption. From there, banks and others could rely on blockchain's transparent and immutable settlement characteristics "as part of your stack for the onboarding, distribution, and revocation of keys in a way that can be portably transported across independent blockchain networks."

While banks may serve as the ideal authenticators and potential holders of a digital ID, one obstacle that would need to be overcome is banks' willingness to share data and cooperate, something they've not always been keen to do, said Andy Schmidt, principal executive adviser at the consulting firm CEB.

"A difficulty with that model is that it presumes you have one banking relationship," he said. "Most consumers have more than one; if you are able to take your various banking relationships and then designate one bank [as your ID authenticator] that could work, but then all the banks involved would have to share data. Are they willing to give up some control in order to create value for a customer?"

There would "definitely be some security concerns" over such a model, Schmidt said, but ultimately, he said, a blockchain-powered universal identity would still be better than the current personal information-intensive model currently used. For instance, Winkelspecht said, the current method of password-based online authentication is faulty, since consumers have to remember different combinations of usernames and passwords for any number of websites. Also, Winkelspecht said, many reuse the same password multiple times, which facilitates fraud.

"There's no perfect solution," Schmidt said, "so there's a potential downside to any idea. But the downside to this is less than the downside to the current methods we have. I think the blockchain is the most enabling and disruptive technology any of us have seen so far. If harnessed properly, it will revolutionize the way we exchange information."

Although Ramamurthi said he believes there are no technology hindrances to creating a universal, federated identity, he said it will not happen until governments become involved in driving this. He pointed to digital ID initiatives in Estonia and in India that have seen widespread adoption and were the result of government drive to institute them.

But ultimately, he said, if there is a will to do this, there is already a way.

Despite the hurdles, such as compliance and security concerns and government cooperation, in creating universal digital ID, Gem's Winkelspecht is confident it will one day happen.

"People have to stop thinking about blockchain as fintech; it's not fintech, it's about how do we build a global computer," he said. "And if you have that, how then do we log into the global computer?"

By Bryan Yurcan

Digital and Economic Espionage (Infographic)

Over the last couple of years, countries competing for either economic or military power have either instigated or fallen victim to economic espionage. As wars become unappealing, these governments have turned to digital espionage, making cyberspace the new field of battle for nations around the world. Digital espionage is a form of hacking conducted for either political or economic reasons, such as stealing secret information to engineer new technologies based on the stolen information or strictly for political reasons. As this trend catches on, the number of economic espionage incidents is expected to increase in the future. Increased Internet penetration to all parts of the world will also promote this trend.

To learn more, check out this infographic created by Norwich University’s Online Master of Science in Information Security & Assurance program.

Norwich University’s Online Master of Science in Information Security & Assurance Program

Cost of Economic Espionage

Theft of American intellectual property is estimated to cost $100 billion annually in financial losses. Theft of trade secrets takes places when someone knowingly misappropriates or steals trade secrets for the economic benefit of another person or organization other than the owner. Foreign competitors or governments responsible for digital espionage usually establish business relationships between their companies and U.S. industries with the aim of gathering intelligence and propriety information.

Cyber Espionage Incidents

In the year 2014, 548 cases of cyber espionage incidents were reported in the United States alone. Theft of trade secrets accounted for 85.8% of these incidents while theft of credentials, internal data, system data, personal data and classified data accounted for 11.4%, 8.5%, 6.6%, 2.6% and 2.4% respectively. In the last year, the Federal Bureau of Investigations reported a 53% increase in attempts to steal propriety information from U.S. companies.

It is important to note that the majority of digital espionage starts with emails. Hackers normally send emails to their targets. The recipients of these baited emails usually fall victim to digital espionage when they open emails with phishing messages (23%) or when they click on attachments (11%).

Intellectual Property Rights Violations and Practices

According to the office of U.S. Trade Representative, there are 13 countries on the priority watch list for intellectual property rights violations and practices. They are; China, Russia, India, Indonesia, Thailand, Venezuela, Algeria, Ukraine, Argentina, Chile, Ecuador and Kuwait. This is because the majority of cyber attacks have emanated from these countries. In recent years, there have been many threats emanating from China. That is why it is on top of the watch list. Russia, due to its historical relations with the U.S., doesn’t fall behind in these attacks but many of them are from individual hackers acting independently. The number of attacks emanating from India can be attributed to the booming IT industry. In fact, India has the largest number of programmers and IT professionals in the world. Attacks from India can be attributed to independent hackers, not the government.

Espionage in Action

U.S./Israeli Espionage on Iran

In 2010, the United States and Israeli governments teamed up to suppress Iran’s nuclear ambitions. Their weapon of choice was a malicious worm known as Stuxnet. The 500kb worm infected more than 14 industrial sites in Iran, including a uranium enrichment plant. This is a great example of how digital espionage can be used to meet political ends. The success of this mission is the stuff of legends as it proved that military incursions or action is not the only way to fight a war.

Chinese Espionage on the United States

In 2013, the Department of Defense revealed that 37 Pentagon weapons programs and 29 defense technologies had been accessed by Chinese agents. A year later, there were two major breaches of U.S. government databases – the security clearance files of 22.1 million people and personnel records. This breach was attributed to Chinese hackers acting as agents of their government. Obviously, the Chinese government refuted these allegations. The incident put China on top of the watch list of countries which promote intellectual property violations and practices.

Fighting Digital Espionage

According to a recent study, over 88% of U.S. businesses and IT professions rate cyber security among the top three threats facing organizations today.

Prevention Strategies

Individual consumers, businesses, government agencies, research institutions and learning institutions use different types of strategies to combat digital espionage. 91 percent of these Internet users use a risk-based cybersecurity framework to prevent cyber attacks. On the other hand, 69 percent use cloud-based cybersecurity services. An estimated 65 percent have liaised with third party cyber security firms to improve security. On the other hand, 59 percent of users leverage big data to monitor and prevent attacks. That said, there are many others who think these attacks are imminent, so they’ve taken up cybersecurity insurance policies to protect themselves from financial losses which may result from theft of intellectual property or trade secrets. The cost of staving off cyber attacks has eaten into the profits of both small and large businesses. Many organizations have hired a chief information security officer to oversee their information security program. Threat assessments are important in improving cybersecurity because they help to identify weaknesses so that appropriate measures can be taken to improve the organization’s information security. Unfortunately, only 49 percent of organizations conduct threat assessments on a regular basis. Furthermore, only 48 percent actively monitor and analyze security intelligence. Obviously, more organizations need to adopt strategies which have proven to be affective in monitoring and preventing cyber attacks.

Cybersecurity Job Growth

There are always two sides to every story. Similarly, the threat of digital espionage has created a huge demand for cybersecurity experts. While the pros may be significantly outweighed by the cons, hundreds of thousands of people have gained employment as a result of the threat, but that is just the nature of capitalism. From the year 2010 to 2013, there was a 91 percent increase in the number of cybersecurity jobs in the United States. In 2014 alone, for instance, there were 238,158 cybersecurity job listings across the United States. As the threat continues to grow, more and more cybersecurity jobs are being created. New strategies for improving information securities are also being formulated as a result.

Congressional Report Slams OPM on Data Breach

Or....Why my digital fingerprints and TS background file are now in the hands of, God only knows who!!

The massive data breach at the U.S. Office of Personnel Management (OPM) that exposed background investigations and fingerprint data on millions of Americans was the result of a cascading series of cybersecurity blunders from the agency’s senior leadership on down to the outdated technology used to secure the sensitive data, according to a lengthy report released today by a key government oversight panel.

OPM offices in Washington, DC. Image: Flickr.

The 241-page analysis, commissioned by the U.S. House Oversight & Government Reform Committee, blames OPM for jeopardizing U.S. national security for more than a generation.

The report offers perhaps the most exhaustive accounting and timeline of the breach since it was first publicly disclosed in mid-2015. According to the document, the lax state of OPM’s information security left the agency’s information systems exposed for any experienced hacker to infiltrate and compromise.

“The agency’s senior leadership failed to fully comprehend the extent of the compromise, allowing the hackers to remove manuals and other sensitive materials that essentially provided a roadmap to the OPM IT environment and key users for potential compromise,” the report charges.

Probably the most incisive portion of the assessment is the timeline of major events in the breach, which details a series of miscalculations on the part of the OPM leadership. The analysis paints the picture of a chronic — almost willful — underestimation by senior leadership at OPM about the seriousness of the threat facing the agency, until it was too late.

According to the report, the OPM first learned something was amiss on March 20, 2014, when the US-CERT notified the agency of data being exfiltrated from its network. In the ensuing weeks, OPM worked with US-CERT to implement a strategy to monitor the attackers’ movements to gather counterintelligence.

The only problem with this plan, according to the panel, was that the agency erroneously believed it had cornered the intruder. However, the hacker that OPM and US-CERT had eyes on wasn’t alone. While OPM monitored the first hacker [referred to in the report only as Hacker X1] on May 7, 2014 another hacker posed as an employee of an OPM contractor (Keypoint) performing background investigations. That intruder, referred to as Hacker X2, used the contractor’s OPM credentials to log into the OPM system, install malware and create a backdoor to the network.

As the agency monitored Hacker X1’s movements through the network, the committee found, it noticed hacker X1 was getting dangerously close to the security clearance background information. OPM, in conjunction with DHS, quickly developed a plan to kick Hacker X1 out of its system. It termed this remediation “the Big Bang.” At the time, the agency was confident the planned remediation effort on May 27, 2014 eliminated Hacker X1’s foothold on their systems.

The decision to execute the Big Bang plan was made after OPM observed the attacker load keystroke logging malware onto the workstations of several database administrators, the panel found.

“But Hacker X2, who had successfully established a foothold on OPM’s systems and had not been detected due to gaps in OPM’s security posture, remained in OPM’s systems post-Big Bang,” the report notes.

On June 5, malware was successfully installed on a KeyPoint Web server. After that, X2 moved around OPM’s system until July 29, 2014, when the intruders registered opmlearning.org — a domain the attackers used as a command-and-control center to manage their malware operations.

Beginning in July through August 2014, the Hacker X2 exfiltrated the security clearance background investigation files. Then in December 2014, 4.2 million personnel records were exfiltrated.

On March 3, 2015, wdc-news-post[dot]com was registered by the attackers, who used it as a command-and-control network. On March 26, 2015, the intruders begin stealing fingerprint data.

The committee found that had the OPM implemented basic, required security controls and more expeditiously deployed cutting edge security tools when they first learned hackers were targeting such sensitive data, they could have significantly delayed, potentially prevented, or significantly mitigated the theft.

For example, “OPM’s adoption of two-factor authentication for remote logons in early 2015, which had long been required of federal agencies, would have precluded continued access by the intruder into the OPM network,” the panel concluded.

Unfortunately, the exact details on how and when the attackers gained entry and established a persistent presence in OPM’s network are not entirely clear, the committee charges.

“This is in large part due to sloppy cyber hygiene and inadequate security technologies that left OPM with reduced visibility into the traffic on its systems,” the report notes. “The data breach by Hacker X1 in 2014 should have sounded a high level, multi-agency national security alarm that a sophisticated, persistent actor was seeking to access OPM’s highest-value data. It wasn’t until April 15, 2015 that the OPM identified the first indicator that its systems were compromised by Hacker X2.”

The information stolen in the breach included detailed files and personal background reports on more than 21.5 million individuals, and fingerprint data on 5.6 million of these individuals. Those security clearance background reports often included extremely sensitive information, such as whether applicants had consulted with a health care professional regarding an emotional or mental health condition; illegally used any drugs or controlled substances; experienced financial problems due to gambling.

The intrusion, widely attributed to hackers working with the Chinese government, likely pointed out which federal employees working for the U.S. State Department were actually spies trained by the U.S. Central Intelligence Agency. That’s because — unlike most federal agencies — the CIA conducted its own background checks on potential employees, and did not manage the process through the OPM.

As The Washington Post pointed out in September 2015, the CIA ended up pulling a number of officers from its embassy in Beijing in the wake of the OPM breach, mainly because the data leaked in the intrusion would have let the Chinese government work out which State Department employees stationed there were not listed in the background check data stolen from the OPM.

As bad and as total as the OPM breach has been, it’s remarkable how few security experts I’ve heard raise the issue of what might be at stake if the OPM plunderers had not simply stolen data, but also manipulated it.

Not long after congressional hearings began on the OPM breach, I heard from a source in the U.S. intelligence community who wondered why nobody was asking this question: If the attackers could steal all of this sensitive data and go undetected for so long, could they not also have granted security clearances to people who not only didn’t actually warrant them, but who might have been recruited in advance to work for the attackers? To this date, I’ve not heard a good answer to this question.

A copy of the 110 mb report is available here (PDF).

By Brian Krebs for Krebs on Security