A week of scary network threats from Black Hat, McAfee’s Rat Report and more on RSA data breach

The report adds: “The definition of successful defense has to change from ‘keeping attacks out’ to ‘sometimes attackers are going to get in; detect them as early as possible and minimize the damage’ Assume that your organization might already be compromised and go from there.” The focus, they say, needs to be more on working with business managers to ascertain the “crown jewels” of the organization and protect these “core assets.”

Other hot security news this week included:

Black Hat: Lots of hacks and a patriotic plea

Black Hat hasn’t disappointed this year, with research revealing a flaw that undercuts Open Shortest Path First routing, two separate assertions that security for Apple products in the enterprise isn’t that bad and a friendly hand being offered to hackers and crackers to join the U.S. fight against terrorists in cyberspace. Perhaps the biggest blockbuster, because of the sheer scope of the potential problem, is the vulnerability an Israeli researcher found in the OSPF routing protocol that puts networks using it at risk of attacks that compromise data streams, falsify network topography and create crippling router loops.

Black Hat: Researcher picks apart Sophos antivirus package

A researcher presenting at Black Hat picked apart Sophos Antivirus software and found it lacking in several areas that leave it vulnerable to attack or circumvention – something he says might apply to other antivirus vendors’ products as well, but he just hasn’t looked. Tavis Ormandy, who works as a researcher for Google, says he reverse engineered the product and found, among other things:

* The key used to encrypt some data is stored with the data, making it relatively easy to decrypt.

* Its buffer overflow protection only works on Windows platforms prior to Vista.

* The signatures Sophos selects to identify viruses are weak and can be generated independent of Sophos, making it possible to flood users with false positives.

Black Hat: System links your face to your Social Security Number and other private things

Soon it will be practicable to take someone’s photo on a smartphone and within minutes know their Social Security number and a range of other private data like their personal interests, sexual preference and credit status, researchers told the Black Hat security conference this week. The technique calls for linking faces of random individuals to images in databases that contain other information about them and using that information to project Social Security numbers, says Alessandro Acquisti, a professor at Carnegie Mellon University, who will present the research at the conference.

U.S. wants to build cybersecurity protection plan for cars

As cars and other forms of transportation increasingly rely on online systems for everything from safety to onboard entertainment, the cybersecurity threat from those who would exploit such electronic control packages has also increased. That’s why the US Department of Transportation (DOT) today issued a Request For Information to the security industry to help it create a road map to build “motor vehicle safeguards against cybersecurity threats and assure the reliability and safety of automotive electronic control systems.”