NATO Article 5 and Cyber Attack

The US wants to cut its budget, but NATO is putting pressure on them to keep their commitments under Article 5.

Article 5 of the NATO treaty requires the Alliance to come to the aid of member-states if their territory comes under attack.

[…]

For the new NATO members, American troops continue to act as a hedge against what they see as Moscow’s unpredictable foreign policy.

“The nations that have been most concerned about the credibility of Article 5 are the Central Europeans,” Brzezinksi [former US Deputy Assistant Secretary of Defense for Europe and NATO Policy] said. “People remember that Estonia had a cyber attack that originated in Russia, and which most believe was organized by the Russian government.”

NERC Issues Risk Methodology Warning

The Bulk Power System of the United States must comply with NERC standards CIP-002 through CIP-009.

The standards are setup so that CIP-002 has a significant influence over the need for standards CIP-003 through CIP-009. It requires a regulated entity to use a risk-based assessment methodology (RBAM) to identify critical assets. In other words, a RBAM is meant to set how much of an environment is within scope of review.

This is not a unique approach. If you are familiar with PCI this is like saying a regulated entity has to determine the systems that process, transmit or store cardholder data to set the scope.

Unfortunately NERC, in their December 2010 Sufficiency Review, says entities are failing to properly identify and document their critical assets.

As a result of audits conducted over the past couple of years through the CIP compliance monitoring program, NERC has found instances where entity methodologies are not sufficiently comprehensive to produce a complete and accurate list of critical assets. This suggests greater clarity is needed in either NERC standards or industry guidelines to provide a more accurate identification of entity critical assets. While in many cases, functional entities had similar methodologies, substantial differences were evident even amongst entities within the same registered function. In certain cases, this has led to audit findings of non-compliance.

The London Schools on Libya

It is hard for me, an alumnus of both the London School of Economics (LSE) and the School of Oriental and African Studies (SOAS), not to juxtaposition their announcements on recent international news.

Professor Stephen Chan OBE at SOAS has provided commentary on the characteristics of the current uprisings in Libya and Egypt and the underlying reasons behind the demonstrations.

Meanwhile, I received the following alert in my inbox from LSE with a link to a full announcement. The LSE Student Union has successfully pushed out the Director after protesting his ties to Libya.

It is with great regret that I am writing to inform you, as an alumnus/alumna of LSE, that the LSE Council has accepted the offer of resignation of Sir Howard Davies as Director. This follows an extraordinary meeting of the LSE Council yesterday evening. Sir Howard has, at the behest of the Council, agreed to continue to serve as Director whilst arrangements for succession are resolved.

At the same meeting, Council also resolved to commission an independent external inquiry into the School’s relationship with Libya, to be Chaired by Lord Woolf.

Sir Davies now says his decision to accept £300,000 from the son of Col Gaddafi has “backfired” as he has lost the confidence of the student body.

There were risks involved in taking funding from sources associated with Libya which should have been weighed more heavily in the balance, he concluded in his resignation letter.

He said the decision to accept the British government’s invitation to become an economic envoy to Libya had “muddled” his personal position and his role at the LSE.

A former head of the Financial Services Authority and deputy governor of the Bank of England, Sir Howard gave advice to the Libyan Investment Authority.

He said he was offered a $50,000 (£30,700) fee for doing so, but asked that it be used for a scholarship at the LSE.

The LSE Student Union also has successfully redirected the £300,000 amount from Gaddafi into scholarships for North African students.

This perhaps illustrates the irony of the political history of these two London schools. LSE, which was a liberal institution of social change, has come to serve and represent some of the most conservative voices in the world while SOAS, once an institution of military/colonial intelligence and training, has evolved into a liberal thought leader for students of the developing world.

CSI: Microsoft — Malicious Autostart

Mark Russinovich of Sysinternals fame is promoting his new book with “The Case of the Malicious Autostart”

This one starts when Microsoft support got a call from a customer representing a large US hospital network reporting that they had been hit with an infestation of the Marioforever virus. They discovered the virus when their printers started getting barraged with giant print jobs of garbage text, causing their network to slow and the printers to run out of paper. Their antivirus software identified a file named Marioforever.exe in the %SystemRoot% folder of one of the machines spewing files to the printers as suspicious, but deleting the file just resulted in it reappearing at the subsequent reboot. Other antivirus programs failed to flag the file at all.

Will the engineer assigned to the case find the smoking DLL?

Will Microsoft be able to catch and stop the malware before nuclear missiles are launched?

He could have spiced it up a bit with some character development (instead of just “The engineer”) but if you’re interested in a stream of facts it’s a great read.

And if you like this, you’ll love the Compound Case of the Outlook Hangs.