Department of Defense tries to court hackers – CNN.com

Dear hackers: The U.S. government wants you.

Or, at the very least, the Department of Defense’s research wing wants to pay you to help it block cyber threats, a project manager at the Defense Advanced Research Projects Agency said Thursday.

Former hacker Peiter Zatko announced the start of a fund-the-hackers program, called Cyber Fast Track, in a keynote talk at the Black Hat conference, which is aimed at hackers and computer security experts. The program began officially late Wednesday, he said.

Experts say the government has done a lousy job in the past of getting money to security researchers quickly enough for them to actually help mitigate cyber threats. Or the feds have avoided dealing with hackers entirely.

via Department of Defense tries to court hackers – CNN.com.

Computer forensics growing part of Fed cybersecurity strategy

Computer forensic investigations aren’t just fodder for popular crime scene television shows. As federal computing environments expand and become more complex, and the numbers of attacks on government systems soar, it is increasingly critical for agency managers to understand how computer forensics fit as an element in their overall cybersecurity strategy, experts say.

You’re going to use these computer forensics tools for either your own internal investigations or to take evidence to court.

Barbara Guttman, manager, National Institute of Standards and Technology (NIST)

“I would think any responsible shop would use [forensics tools],” said Barbara Guttman, manager of the component software group at the National Institute of Standards and Technology (NIST). “I would certainly consider your organization a poor one if you weren’t using these tools in your computer security operations.”

According to the U.S. Computer Emergency Readiness Team (US-CERT), the operational arm of the National Cyber Security Division at the Homeland Security Department, “adding the ability to practice sound computer forensics will help you ensure the overall integrity and survivability of your network infrastructure.”

In a white paper on computer forensics, US-CERT experts say, “You can help your organization if you consider computer forensics as a new basic element in what is known as a ‘defense-in-depth’ approach to network and computer security.”

Computer forensics is a relatively new discipline, and practices in the field are in a state of flux, US-CERT says. Forensics is traditionally associated with the scientific collection of evidence for use in legal procedures and court cases. But as computer forensic tools become more powerful, agency security managers also can use them to meticulously collect information about activities on their networks and conduct a variety of security investigations.

via Computer forensics growing part of Fed cybersecurity strategy.

Digital Forensics Go Mobile – SIGNAL Magazine

Digital-data investigators have a new tool in their arsenals as they try to capture bad guys’ information before they can harm others. The device enables immediate, on-scene triage of devices, eliminating the need to send equipment back to a laboratory while saving precious time and resources.

Dell released its Mobile Digital Forensics solution to build upon its original Digital Forensics offering. As devices such as computers, smartphones and even gaming consoles with storage capabilities grow in popularity, they become increasingly critical sources of information. Joe Trickey, rugged and digital forensics brand manager at Dell, says the number and capacity of these platforms result in a digital tsunami. Investigators need methods to more quickly process the data they collect to counteract this overload. In some cases, faster evidence collection could enable catching criminals or stopping attacks.

Chris Townsend, rugged solutions manager at Dell, explains that the mobile solution was designed for the layperson, not forensics specialists, to use. It requires no specific skills to operate as it reviews content, finds fields and key words, and helps maintain security. The solution has applications in a range of areas including intelligence-community and defense operations. For example, a warfighter out on patrol could use the tool to collect information from a house and send the findings back to experts to identify actionable intelligence. The solution also can be configured to help private companies detect problems such as insider trading.

Law enforcement agencies also are major users of Digital Forensics and Mobile Digital Forensics. Trickey shares a story in which law enforcement officials were tracking a gang-related case and were able to collect information about a hit made in Las Vegas when the guilty party discussed the crime via a friend’s gaming station. One of the most common applications for the device is in cases of crimes against children such as kidnapping or exploitation.

via Digital Forensics Go Mobile – SIGNAL Magazine.

Adobe Aims to Improve Privacy Settings in Flash – Digits – WSJ

Adobe Systems Inc. says it is working to improve the privacy controls in its popular Flash video player, amid concerns over companies using the software to track Web users.

So-called “Flash cookies,” which are small files stored on a user’s computer through the Flash program, have raised privacy questions because they are more difficult for users to detect and delete than regular cookies associated with Web browsers. Flash cookies can be used to track a person’s surfing behavior from site to site, and they can be used to “respawn” other cookies that a user has deleted. Flash is used for most of the Web’s video content and animation.

Soon, users of Google Inc.’s Chrome Web browser will be able to delete these Flash cookies the same way they delete regular cookies, by going to the privacy options in the browser, Adobe said in an official blog post. Other browsers are expected to get the capability in the future as well, Adobe said, although it’s unclear when that will be.

Currently, to delete Flash cookies, users typically must either go to the files on the computer itself, or make changes in Adobe’s settings manager for Flash — a process that can be confusing. Adobe now says it also will redesign the settings manager in the first half of this year. “We know the Flash Player Settings Manager could be easier to use,” the company said.

In making these changes, Adobe is joining other Web technology companies in taking a closer look at privacy, which has become a hot topic in recent months. Microsoft Corp. late last year said it would revive a privacy feature in Internet Explorer similar to one it dropped from an earlier version of the Web browser because of concerns about alienating advertisers. Mozilla, which makes the Firefox browser, has discussed similar options, and the Federal Trade Commission is encouraging browser makers to improve the privacy controls on their software. The tracking technology at the heart of the debate is the focus of a Wall Street Journal Investigation, What They Know.

via Adobe Aims to Improve Privacy Settings in Flash – Digits – WSJ.

Microsoft To Business Users: Hold Off On IE9 — InformationWeek

Microsoft is advising enterprise customers to wait until a final version of Internet Explorer 9 is available before adopting the browser on business PCs.

“Until the final code of Internet Explorer 9 is released to the Web (RTW), we recommend businesses first move to Windows 7 Enterprise with Internet Explorer 8,” said Rich Reynolds, Microsoft’s general manager for Windows Commercial Product Marketing, in a blog post Wednesday.

Doing so, said Reynolds, would allow them to “immediately benefit from the enhanced security, manageability, Web standardization, and lifecycle support that Internet Explorer 8 brings to enterprise browsing today.”

Microsoft released the beta version of Explorer 9 last week, but has yet to commit to a launch date for the final version. The company is counting heavily on Internet Explorer 9 to maintain its majority share in the browser wars, which has been eroding steadily in recent years amid new competition from Apple Safari and Google Chrome.

Advanced features on IE9 include full HTML 5 support, faster JavaScript, a tool that lets users “pin” their favorite sites directly to the Windows 7 taskbar, and a cleaner interface designed to highlight Web pages as opposed to the browser itself.

via Microsoft To Business Users: Hold Off On IE9 — InformationWeek.

Apple manager arrested in kickback scheme – San Jose Mercury News

A midlevel Apple manager was arrested Friday and accused of accepting more than $1 million in kickbacks from half a dozen Asian suppliers of iPhone and iPod accessories in a federal indictment unsealed and a separate civil suit.

Paul Shin Devine, a global supply manager, and Andrew Ang, of Singapore, were named in a 23-count federal grand jury indictment for wire fraud, money laundering and kickbacks.

“Apple is committed to the highest ethical standards in the way we do business,” Apple spokesman Steve Dowling said in a statement. “We have zero tolerance for dishonest behavior inside or outside the company.”

The alleged scheme used an elaborate chain of U.S. and foreign bank accounts and one front company to receive payments, the indictment said, and code words like “sample” were used to refer to the payments so that Apple co-workers wouldn’t become suspicious.

Devine, 37, of Sunnyvale, is being held by the U.S. Marshals Service, according to the Internal Revenue Service. He could not be reached for comment. IRS Agent Arlette Lee declined to comment on Ang’s whereabouts.

via Apple manager arrested in kickback scheme – San Jose Mercury News.

Can You Be (Legally) Fired For Using (Legally) Prescribed Marijuana? – Law Blog – WSJ

Here’s an interesting dilemma. You’re a human-resources manager at a company in a state that has a law allowing the use of medical marijuana in certain situations. You find out that one of your employees is using marijuana to treat a chronic medical problem, in violation of your company’s drug policy.

What should you do?

A story out on Tuesday by WSJ reporter Stephanie Simon suggests the following: consult your lawyer (but don’t be surprised if it takes a while for that lawyer to figure out the answer).

On the one hand, reports Simon, employers can fire, or refuse to hire, employees for using marijuana without running afoul of the Americans with Disabilities Act or any other federal anti-discrimination statute.

But state law is a bit less settled. The state Supreme Courts in Oregon, California and Montana and the Washington Court of Appeals have all ruled that employers have a right to fire medical-marijuana patients for using the drug. The medical-marijuana laws in Rhode Island and Maine state that most employers may not penalize individuals solely because of their status as marijuana patients.

via Can You Be (Legally) Fired For Using (Legally) Prescribed Marijuana? – Law Blog – WSJ.

Seagate: 3TB Drive En Route, but with Potential Issues | PCMag.com

Not that it should come as a huge surprise that a major hard drive manufacturer is working on ever-larger storage capacities, but a Seagate senior product manager has confirmed to Thinq that the company is planning to unveil a 3TB hard disk later this year.

Barbara Craig, the product manager, said that the move to 3TB involves a heck of a lot more work than just upping the areal density this time around. “The root of the problem is the original LBA (logical block addressing) standard, which can’t assign addresses to capacities in excess of 2.1TB,” the report said-a problem that’s been lying in wait since Microsoft and IBM developed the original DOS standard in 1980.

The potential ramifications of this so far appear to be what OSes will be compatible with 3TB drives.

Craig said that Seagate plans to extend the standard to Long LBA addressing, which would work in 64-bit Windows 7 and Vista as well as Linux, but wouldn't work in 32-bit Vista or any version of Windows XP, the report said.

via Seagate: 3TB Drive En Route, but with Potential Issues | News & Opinion | PCMag.com.

Should Law Firms Outsource or Insource E-Discovery Tools? || ESIBytes

Listen to Karl Schieneman, Director of Legal Analytics and Review with JurInnov talk with Stephanie Maw, Litigation Support Manager with Cincinnati based Keating Muething and Klekamp, PLL and Chris Olsson, CEO of Cricket Legal Technologies and a former E-Discovery Technology Manager for an Am-Law 20 law firm discuss the complex issues associated with this question. What it takes for a law firm to be able to sustain managing technology in e-discovery, the risks of owning software, when it makes sense, and other issues will be discussed.

Because this show was created from San Juan, Puerto Rico on a cell phone, there were a few technical problems with me losing contact with the show which required me to edit part of the show. It was still a very interesting dialogue and the only edits reflected dialogue involving me rejoining the call and asking what had happened while I was off. Like every E-discovery project, things sometimes don’t go perfectly. My guests were outstanding and carried on without me for the 5 minutes or so which I lost audio contact. Enjoy.

via Should Law Firms Outsource or Insource E-Discovery Tools? || ESIBytes.