Category: Trends

“The need for security is expanding beyond the PC,” wrote Jonathan Singer, an analyst with the Yankee Group, in an e-mail to TechWeb. “Mobile devices such as smart phones and PDAs, which are often used for business purposes without security integration, are opening new avenues for malicious code,” he added.

Early efforts by hacker to engage these devices were relegated to using them as entry points for viruses and worms delivered via e-mail, but as networked handhelds proliferate, tactics have changed. As other devices become networked–such as printers and copiers–and as voice over IP (VoIP) hardware grows in popularity, they’ll be targeted too, or used to launch additional attacks.

“Look for these types of attacks to become pervasive in the next 12 to 24 months,” Singer said.

Behavioral-based anti-virus protection doesn’t rely on one-to-one signatures to match against known malicious code, but examines possible malware for characteristics common to viruses and worms. Among their advantages are a theoretical ability to recognize unknown viruses–thus providing a defense against so-called “zero-day” attacks–less frequent updating, and smaller size.

“In the next two to four years, anti-virus software will migrate from signature recognition to a hybrid of signatures and behavioral recognition,” predicted Singer.

Enterprises should set policies on PDA and smartphone use, said Singer, to protect the network first, make handhelds productive second.

http://story.news.yahoo.com/news?tmpl=story&ncid=1211&e=10&u=/cmp/20041020/tc_cmp/50500906&sid=95609566

“The IPS market in Europe is a few quarters behind North America. But a couple of quarters ago is the time when IPS took off in the US,” said Kip McClanahan, chief executive of TippingPoint, speaking at the NetEvents gathering of networking analysts, vendors and press in Barcelona on Friday. He added that TippingPoint expected to see a “very significant” uptake in demand in Europe, Middle East and Africa.

Intrusion prevention systems conduct deep-packet inspection of the traffic moving across a company’s network. TippingPoint argues that IPS is a more sensible choice than an intrusion detection system, which will alert a network administrator of potential problems but not act against them.

Price tags of £50,000 are not uncommon — but in today’s security climate they can make sense for large companies, and organisations such as universities which can’t trust their end users to run their own security protection. Both TippingPoint and Internet Security Systems, another IPS vendor, are keen to point out that IPS products protect against vulnerabilities rather than just exploits. Both companies say that their customers were protected from the recent JPEG virus, because the vulnerability it took advantage of had already been identified.

Other security companies told the NetEvents audience that 802.1x, which places authentication on each network port, will play a big role in network security. But the IPS vendors say it isn’t enough to just put security on the perimeter. “If I’m a malicious employee and I want to run something bad on your network, then port monitoring won’t stop me,” said Marc Willebeek-LeMair, TippingPoint’s chief technology and strategy officer.

http://news.zdnet.co.uk/internet/security/0,39020375,39169783,00.htm

IT security spending is set to almost double from 2.5 per cent of overall technology spending to four per cent within the next four years, while spam is will increase from 17 billion emails today to 23 billion by 2007.

‘Almost half of emails will be spam related in the future,’ said Thomas Raschke, IDC’s program manager for European security products and strategies, speaking at the analyst’s 2004 Security Conference in London. ‘On average employees will use 10 minutes of their day identifying spam and getting rid of it. When you add this up businesses face massive losses connected to it,’ he said.

Rather than developing a reliance on new security products, IT directors need to realise the importance of enforcing security policies and run a risk analysis every month, especially when implementing higher risk technologies, such as mobile policies and peer-to-peer projects, says Raschke. ‘Security policies need to be checked and re-evaluated constantly. Firms should build in rules governing what people can access using the corporate network – it’s often an overlooked part of the business,’ he says.

But by undertaking proper risk analysis organisations may discover parts of the business that require less IT security spending than others. ‘Not everything needs to be one hundred per cent secure, for instance lots of information is shared with partners and customers on the internet,’ said Raschke.

A growth in malicious attacks, viruses and spyware will also lead to a 15.4 per cent increase in security software spending over the next four years, with firms investing more on intrusion detection, secure content management, firewall and VPN software.

‘It is easy to create maximum damage to systems with little effort these days, it’s as simple as going to an internet site and loading virus writing tools,’ said Raschke.

IDC also predicts spending on security hardware appliances will also grow by 23 per cent between 2003 and 2008, as IT departments look for methods to monitor all areas of IT security.

http://www.vnunet.com/news/1158623

According to research from analyst firm IDC, nine million IT workers and their companies in the Europe, Middle East and Africa (EMEA) region are already generating more than $200bn in tax receipts. And that number is expected to grow.

“We are in the midst of an IT rebound in EMEA,” said Thomas Vavra, software and consulting manager for IDC. “Western Europe was hit hard, but emerging markets have mitigated losses and are expanding. “That’s a benefit for government because it will have less unemployment expenses and there will be a number of new people in IT.”

IDC surveyed 19 countries in the EMEA region. It predicted that IT spending is set to improve — the company said that by 2008 spending would reach a value of $360bn.

“We expect that over four years we will see a representation of new jobs connected with software,” said Vavra. “In many of the emerging markets, countries are moving away from infrastructure IT to software.” Vavra added that more than a third of 2004 tax revenues came about because of ‘the vast Microsoft ecosystem’. He said that for every dollar of Microsoft revenue in the region, another seven and a half were generated by companies, which sell technology to run on the company’s operating systems.

Countries examined in the study included: the Czech Republic; Hungary; Israel; South Africa; Austria; Denmark; France; Germany and the UK among others.

http://news.zdnet.co.uk/business/0,39020645,39168980,00.htm

A survey of 168 organizations in the United Kingdom found that more than half expected IT spending to increase over the next year by an average of 1.9 percent. The annual Benchmark of IT Spending was conducted by Britain’s National Computing Centre. That figure of 1.9 percent varies widely over different sectors.

In central government, manufacturing and finance, overall IT spending is predicted to actually fall over the next year. Ian Jones, head of content and publishing at the NCC, described the outlook of IT buyers as “cautiously optimistic.”

The bulk of IT budgets is still taken up by running and maintaining the existing infrastructure, with operational costs making up 68 percent of total spending. Fresh investment in IT only accounts for 28 percent, with the rest accounted for by end users and other sources within the organization. Again, the figures differ in each sector, with IT investment greater in central government and finance, and lower in construction and manufacturing.

IT staff remain the single largest budget item, accounting for almost a third of overall budgets. The average level of IT staffing is 26.5 techies per 1,000 end users in a company, which is slightly down from 31 last year. The finance sector has the highest ratio, at over twice this year’s average.

Desktop replacement is the most important IT department activity, and 42 percent of Windows systems are expected to be upgraded over the next two years, mainly to Windows XP. The proportion of sites running Linux desktops remains low, though strong growth is predicted. Jones said the Linux vendors had come in for “a real kicking” after all the rhetoric and hype about open source on the desktop. “It has really made no impact whatsoever on the desktop,” he said. “The Linux vendors need to raise their game.”

The big area highlighted by user organizations is thin-client desktops. These are currently only used in 16 percent of firms, but that is expected to rise to 24 percent over the next two years. Laptops and PDAs are also expected to grow proportionately much faster than desktops, at just more than 50 percent over two years, though the actual numbers remain a lot smaller.

The Windows 2003 server upgrade is also a major project on the table for many companies, while the decline of the mainframe continues apace.

http://news.zdnet.com/Upgrades%2C+HR+costs+squeeze+British+tech+budgets/2100-3513_22-5386982.html?part=rss&tag=feed&subj=zdnn

‘Extending enterprise networks overseas, as a result of increased outsourcing, can create new problems,’ managing vice president Victor Wheatman told delegates at the Gartner IT Security Summit in London this week.

Emerging technology such as web services and wireless personal devices will also expose new holes in IT security plans, he says. ‘Each new technology and way of doing business brings with it a whole range of new IT security concerns,’ he said. ‘And each new wave of technology obliterates the security architecture appropriate to its predecessor, opening the enterprise up to an ever increasing raft of security risks.’

Cybercriminals will be an increasing risk, developing ever-more sophisticated methods of making money using spyware, phishing and spam, says Wheatman.

Gartner says businesses should also put more pressure on vendors to remove security flaws before products are launched. The analyst predicts that a 50 per cent reduction in software vulnerabilities before shipping could remove 75 per cent of configuration management and incident response costs incurred by businesses.

The key to secure business is management improvement, with the most secure firms spending less than average, he says. The lowest-spending 20 per cent of firms are also the most efficient and will safely reduce security spending to only three to four per cent of their total IT budget, says Wheatman.

But to achieve this, investment must shift from product-based purchasing to implementing better-designed risk management processes. ‘We will constantly see new risks because technology and business processes don’t stand still,’ said Wheatman. ‘It’s about keeping the bad guys out, while letting the good guys in and keeping the wheels on.’

http://www.vnunet.com/news/1158271