Red Cross works to better protect its networks from attacks, scams
CISO says the relief agency seeks help as traffic surges
Computerworld - Information security staffers at the American Red Cross, which was hit last month by the Zotob worm, are working overtime to try to protect the organization's networks against attacks amid surges in usage of the networks following Hurricane Katrina.
In addition, the emergency relief agency has turned to the FBI and others for help in preventing the spread of imitation Red Cross Web sites set up by scam artists.
"The infrastructure is stretched, and I'm not sure we can tolerate another outbreak" like the Zotob attack, said Ron Baklarz, the Washington-based organization's chief information security officer.
Zotob, which took advantage of a hole in the plug-and-play component in Microsoft Corp.'s Windows software, "saturated" sections of the Red Cross' networks, making them inaccessible to users for several hours last month, Baklarz said.
Consequently, the organization turned to security experts to "take a second look at the security technologies we have in place today to ensure that we have tuned them as best as we can under the increased load," he said.
The Red Cross is implementing new technologies such as intrusion-detection and -prevention systems -- some of them donated by vendors -- to bolster network security, said Baklarz.
Also, not all of the Web sites that the Red Cross has created for remote field offices set up to aid Katrina victims have a direct link back to the organization's network.
"We are trying to put Web-based applications out there that can be accessed without people coming to the corporate network," Baklarz said without elaborating.
The Red Cross is working with the FBI Internet Fraud Complaint Center to shut down sites allegedly created by scam artists involved in Katrina-related fraud.
"We anticipated there would be a lot of fraudulent activity on the Internet," Baklarz said. "We wanted to triage with the FBI and make sure they saw examples of the legitimate e-mail that is sent out from the Red Cross so that they know what to look for."
Appeals have also been sent to organizations such as Bethesda, Md.-based SANS Institute and various government and nongovernmental agencies to keep an eye out for anything that looks like a scam, Baklarz said. As of last Thursday, about 20 such sites had been identified and were being investigated by the FBI for possible follow-up action.
"Every time an event like this occurs, it brings out the best and the worst in people," Baklarz said. "Unfortunately, in my position, I've got to think about and respond to the worst."
Read more about Security in Computerworld's Security Topic Center.
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Ponemon 2014 SSH Security Vulnerability Report According to research by the Ponemon Institute, 3 out of 4 enterprises have no security controls in place for SSH which leaves organizations...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!