Category: Trends

Howard Schmidt, a former White House security advisor, said the future of security lies in it being baked into systems, networks and processes. Schmidt added that consolidation in the sector was aiding that process with deals in the last couple of years, such as EMC buying RSA Security and Symantec combining with Veritas.

ISC2 board director Richard Nealon said security chiefs need increasingly to play a role in broader risk management, and applauded the role of regulations in mandating more secure regimes at organisations. “Until now, we’ve led a blessed life and our biggest threat was people who didn’t have a lot of malice, motivation, technology or education… They were script kiddies or enthusiasts, and most of the threats came from that vector.”

Now there is motivation and there is money to be made. They’ll produce a business plan, seek funding, allocate resources, and they basically do it for profit motives.

“Security used to be mainly technology then process, so you would have a technology control such as anti-virus or intrusion-detection, and a process such as patching and updating.”

ISC2 board director and consultant Peter Berlich said that although the profile of security is much greater than previously, the roles of chief security officers were still dependent on the nature of employers and industries.

http://www.cio.co.uk/news/index.cfm?RSS&ArticleID=2761

Secondly, the new malicious programs which had appeared in the last few months were also absent from the rankings, although there had been no indication that this would happen.

And finally, this month’s chart contains an increased number of worms which we’ve been detecting for years.This epidemic indicated that someone was preparing to create an enormous botnet.

Our old friend, NetSky.q, continues to lead the rankings this month, and Mydoom.m rose a significant nine places to come in second. The last time these two worms were in such close competition with each other was way back in 2004.

The only program which could more or less be termed new in the entire Top Twenty is another Trojan-Downloader.

All the representatives of the Zhelatin (Storm Worm) and Warezov families have disappeared from the rankings. Worms from the NetSky family have come to fill the void created by the absence of new epidemics, with three of the five programs re-entering the rankings in March belonging to this family.

Overall, March has been the most peaceful month that we’ve seen for a while.

http://www.net-security.org/qualys2008/rsa2008c.html

Implementations of Session Initiation Protocol (SIP), an alternative VoIP protocol, can leave VoIP networks open to unauthorized transport of data.

The VoIPSA tools are intended to help businesses test and secure their networks, but these and other online tools can be used to probe for weaknesses as well.

Part of the reason may be that the largest VoIP vendors use proprietary protocols, such as Cisco’s Skinny, Nortel’s Unistim and Avaya’s variant of H.323, Orans says. SIP, which is gaining popularity, is a mixed bag, Orans says, because it is readily available to those who might want to exploit it. These options include firewalls and intrusion-prevention systems that support SIP (compare products).

Another reason for the lack of broad exploits is that there isnt enough ROI for attackers’ development time.

Hybrid PBX systems — which handle both VoIP and TDM voice — account for 64% of all PBX lines sold, according to a December 2007 Infonetics report.

http://www.networkworld.com/news/2007/121707-crystal-ball-voip-vulnerabilities.html

Lost laptops, emails sent to the wrong address, sensitive documents left on photocopiers, employees walking out of the building with confidential papers or storage media — these are not new sources of leaks, but they remain the most common, the study finds. “Most of these are accidental, not malicious,” Seth says.

Some employees repeat sensitive information on social networking sites such as MySpace or Facebook, while others may be overheard in a restaurant or on an airplane. An employee might be shoulder-surfed at a coffee shop or on a train, or lose an unencrypted storage device in a public place, the study observes.

The study also found some methods of leakage that may not be anticipated, such as “print screen” capabilities or photographing of screens on mobile devices. “I know it’s a tired phrase, but we’re talking about human behavior here, and the only way to correct the problem is to correct the behavior.”

http://www.darkreading.com/document.asp?doc_id=140412&f_src=darkreading_section_296

Intelligence agencies already routinely test other states’ networks looking for weaknesses and their techniques are growing more sophisticated every year, it said. Governments must urgently shore up their defenses against industrial espionage and attacks on infrastructure. It said China has been blamed for attacks in the United States, India, and Germany. “The Chinese were first to use cyberattacks for political and military goals,” James Mulvenon, director of the Center for Intelligence and Research in Washington, was quoted as saying in the report.

The report was compiled with input from academics and officials from Britain’s Serious Organized Crime Agency, the U.S. Federal Bureau of Investigation, and NATO.

http://www.news.com/World-faces-cyber-cold-war-threat%2C-report-says/2100-7349_3-6220619.html?tag=ne.fd.mnbc

The survey, carried out by analysts TNS on behalf of CompTIA, also discovered that for every dollar spent on security about 42 cents goes on technology product purchases, 17 cents for security-related processes, 15 cents for training, 12 cents for assessments, nine cents for certification, and the balance on other costs.

http://www.channelregister.co.uk/2007/10/11/comptia_security_survey/