Category: Trends

The government must assess the risk associated with certain data types so companies aren’t notifying consumers every time a breach of even noncritical data occurs,” asserts Jerry Cerasale of the Direct Marketing Association (DMA), a New York-based trade association representing more than 5,200 direct, database and interactive marketers.

Fred Cohen, a principal analyst at Burton Group (Midvale, Utah), says enterprises should consider creating new positions or morphing existing ones to prepare for such legislation. “The position of a chief information security officer (CISO) exists at many large firms, but it has not been a C-level position,” says Cohen.

http://www.banktech.com/showArticle.jhtml?articleID=177102701

1.) More damages, but fewer epidemics.
2.) Accelerated legislation, some litigation.
3.) Points of attack move beyond Microsoft’s Operating System.
4.) Mobile phone and PDA/ Smartphone virus concerns.
5.) Spyware a major issue.
6.) IM and P2P will become a bigger headache.
7.) Messaging security will get serious.
8.) Data protection energized as publicized data breaches in the United States intensify.
9.) Convergence will accelerate; security becomes embedded in the infrastructure.

http://www.csoonline.com/read/010106/caveat010906.html

“The interesting point is to note how technology issues go through a cycle where it’s assumed to be part of the core technology, Mark McDonald, group vice president and head of research for Gartner’s Executive Programmes unit told internetnews.com.

Perhaps indicative of a certain healthy paranoia, two thirds of CIOs believe their competitors make better use of information.

Seven out of ten survey respondents said they need to build new business skills in IT focused on delivering business results. “CIOs who are doing this effectively today enjoy a deeper business relationship, report to the CEO, and play a greater role in strategy formulation and major decisions,” said McDonald. “The distinctions between companies using technology effectively and those that do not are becoming clearer for the CIO and for the business.”

Although business concerns over security breaches and disruptions fell from second last year to the seventh highest ranked priority for this year, Gartner said it remains an important issue.

“It indicates that in 2006 the business expects IT to be secure and is looking to the CIO to keep it that way,” said Marcus Blosch, vice president and research director at Gartner EXP.

Overall, the survey found that IT spending on security related tools remains healthy at a projected average increase of 4.5 percent in 2006.

http://www.internetnews.com/ent-news/article.php/3579391

One issue is the thousands of insecure PHP or other web scripts that get installed and are never updated, even when the programmers come up with fixes.

Security experts at Netcraft, which audits web applications, typically find problems such as weak session management, SQL injection risks, buffer overflows and vulnerable debug code mistakenly left in production applications.

In a paper presented at the JavaOne conference last year, Cisco security architect Martin Nystrom claimed that 95 percent of web applications have flaws, with 80 percent vulnerable to cross-site scripting attacks.

http://www.vnunet.com/itweek/comment/2148638/web-applications-easy-targets

Schmidt, on the Board of Directors of the International Information Systems Security Certification, said he gets calls three or four times a month from companies that recently created executive positions in security. “There’s more attention and focus on IT security as a profession, as opposed to just a job,” Schmidt said.

The factors giving information security professionals greater visibility are: the maturation of the certification process; the increasing mobility of the world’s workforce and subsequent vulnerabilities; growing sophistication among hackers; more stringent regulations regarding data. “A lot of companies are finding themselves being in better financial positions, freeing up funds for investments in staffing and security,” Bohne said.

The IDC study, which culminated from the responses of 4,305 full-time information security professionals in more than 80 countries, showed that information security is most mature in the Americas.

Experience counts for something, but accreditation is helping build credibility in the information security field as well.

http://www.securitypipeline.com/news/175800733

Other phishing trends Netcraft spotted during 2005 included the appearance of pharming attacks and fraudulent e-mails that included HTML-based forms, a tactic that eliminated the need to craft elaborate Web sites to trick users.

Also in 2005, phishing attacks — which are spawned by massive amounts of spam — began using the spammer technique of replacing text with image-based e-mails to avoid detection by keyword-sniffing spam and phishing filters.

http://www.securitypipeline.com/news/175800281