Category: Trends

Workforces in enterprises today are increasingly becoming mobile. All this information seamlessly crosses the internal network boundaries to locomote the internet and come back into the network. This tight coupling, between the enterprise?s internal-network with the mobile user through the internet threatens the existing security initiatives in any enterprise.

The need of the hour is to provide a high level of security without reducing overall performance or increasing costs. This involves securing the entire tunnel of communication between the employee and application.

Previously vendors provided only mobile connectivity solutions containing simply an anti-virus as a security element in the entire mobile connectivity solution.

However, new generation solutions from mobile connectivity solution vendors include a suite of Internet protocol security (IPSec) virtual private network (VPN) based products/solutions for enterprises that need to secure remote access from a remote location by a mobile worker into the corporate networks via mobile devices.

According to Mr. Shende, Director Technology practice with Frost & Sullivan, “Securing mobile users by using secure mobile connectivity solutions helps an enterprise ensure secure connectivity for an employee in a remote location to access the vital information residing inside a company?s network and carry on the transactions just as if he/she was working on the local intranet when in office.

http://www.zdnetindia.com/zdnet2005/mediaturf/top_728x90_1.html

AMR Research compliance guru John Hagerty attributes the shift in spending in part to better guidance from the Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PSCAOB), the watchdog for public accounting firms.

AMR found that many companies focused their SOX efforts this year on refining their existing business and IT control in preparation for automating through technology. According to the AMR survey, more than 80% of companies said they expect to reap business benefits by adding or improving their SOX compliance regimens.

The two biggest areas for SOX investment in 2006, says AMR, will be compliance management software and continuous controls monitoring software.

The report is a sneak peak at the firm’s annual comprehensive survey on SOX spending.

http://searchcio.techtarget.com/originalContent/0,289142,sid19_gci1148856,00.html

“The long-term value of today’s IT specialists will come from understanding and navigating the situations, processes and buying patterns that characterise vertical industries and cross-industry processes,” said Diane Morello, a research vice-president at Gartner, in a media statement.

According to Gartner, the workplace will also spawn a trend which will see the transfer of laptop ownership from company to employee. By 2008, 10 percent of companies will adopt this practice, managing the use of employee-owned laptops with schemes such as notebook allowances.

In addition, the analyst predicts that spending on regulatory compliance will grow at a rate twice that of IT spending. In a bid to keep up with regulatory compliance requirements by the US government and European Commission, businesses may consume discretionary IT budgets. This would leave little resources for organisations to manage initiatives key to business growth, such as exploring the use of new technology, Gartner warned.

The analyst advised IT departments to work with their legal, financial, and corporate departments to ensure business growth.

These and other industry trends are part of Gartner’s research series that discusses major trends affecting IT users, vendors and most industries in 2006 and beyond.

http://news.zdnet.co.uk/business/employment/0,39020648,39238831,00.htm

He explained that large organisations thrive by having a developed understanding of risk, and by accepting it when it offers a business advantage.

Instead of the ability to scare budgets out of chief information security officers, a future risk management officer will be well-versed in communication and project management skills and more likely to have trained in business school than as a techie. “The days of security being handled by the ‘network person’ who did security in their spare time are over and increasingly we are seeing seasoned professionals with real business experience and business school qualifications stepping into the security space.” Business people also need to adapt and realise the security cannot be achieved by technology and needs to be built into a corporate culture. This will require cultural, behavioural, procedural and technical change, according to Gartner.

Proctor made his comments during a presentation at the Gartner IT Security Summit in London.

http://www.securityfocus.com/news/11317

The open-source Mozilla Foundation browsers, such as the popular Firefox, have typically been seen as more secure than IE, which has suffered many security problems in the past.

Mitchell Baker, president of the foundation, said earlier this year that its browsers were fundamentally more secure than IE. She also predicted that Mozilla Foundation browsers would not face as many problems as IE, even as their market share grows.

Symantec’s Internet Security Threat Report Volume VIII contains data for the first six months of this year that may contradict this perception. According to the report, 25 vendor-confirmed vulnerabilities were disclosed for the Mozilla browsers during the first half of 2005, “the most of any browser studied,” the report’s authors stated. Eighteen of these flaws were classified as high severity.

“During the same period, 13 vendor-confirmed vulnerabilities were disclosed for IE, eight of which were high severity,” the report noted. The average severity rating of the vulnerabilities associated with both IE and Mozilla browsers in this period was classified as “high”, which Symantec defined as “resulting in a compromise of the entire system if exploited.”

The Mozilla Foundation did not immediately respond to requests for comment.

Symantec reported that the gap between vulnerabilities being reported and exploit code being released has dropped to six days on average. However, it’s not clear from the report how quickly Microsoft and Mozilla released patches for their respective vulnerabilities, or how many of the vulnerabilities were targeted by hackers, though Microsoft generally releases patches only on a monthly basis.

Symantec admitted that “at the time of writing, no widespread exploitation of any browser except Microsoft Internet Explorer has occurred,” but added that it “expects this to change as alternative browsers become increasingly widely deployed.” There is one caveat: Symantec counts only those security flaws that have been confirmed by the vendor.

According to security monitoring company Secunia, there are 19 security issues that Microsoft still has to deal with for Internet Explorer, while there are only three for Firefox.

The report also highlighted a trend away from the focus of security being on “servers, firewalls, and other systems with external exposure.” Web browser vulnerabilities are becoming a preferred entry point into systems, the report stated. It also highlighted the trend of hackers operating for financial gain rather than recognition, increased potential exposure of confidential information, and a “dramatic increase in malicious code variants”.

http://news.com.com/Symantec+Mozilla+browsers+more+vulnerable+than+IE/2100-1002_3-5873273.html

First a good analogy: “In the history of business and consumer use of the Internet, the vast majority of security approaches have relied on customer premises equipment — security hardware and software at the edge of every business or on the PC of every consumer. This is the equivalent of the water company telling you to put water purifiers onto the water pipe into your house because it is sending you many poisonous substances mixed into your water.”

Despite usability and liability obstacles, few would argue that “immunizing” the network for cyber threats this way doesn’t make sense.