Category: Trends

As the window shrinks between the discovery of vulnerabilities and the exploits that follow them, security patching — once an obscure and neglected chore — is beginning to take on a more urgent role in some corners of the business world, say analysts and IT managers.

Leading the way are organizations with mission-critical technology — chiefly finance agencies — who’ve managed to reduce critical security patch times from weeks to just days.

“In some cases, it took 200 days to roll out a patch across 36,000 machines,” says Rober Garique, VP and CISO of the Bank of Montreal. “Now we can do that in less than a week.”

The key, they say, is that they’ve moved patch management from their small security organizations into their network infrastructure management. It’s a culture shift — a new way of working with network administration, says Mike Corby, director of META Group Consulting. In this model, security teams rate the criticality of each patch, but administrators manage the actual patching as part of their normal network and system management processes.

So the different system administration groups should do their own testing and patching as part of their overall system management.”

For non-critical patches, each bank folds the patches into administrative updates in cycles of one week, three weeks or further out, depending on severity. At Bank of Montreal, this approach gets critical patches to onto over 30,000 devices in two-to-three days.

The Bank of New York boasts similar deployment speeds for an equally-large network.

For non-critical patches, each bank folds the patches into administrative updates in cycles of one week, three weeks or further out, depending on severity. With network administrators handling patch management, IT security is free to assume more of a role of advisor and 9-1-1 operator, sending alerts to administrators assigned to patch the networking segment.

“About two years ago, awareness among the infrastructure people was an issue when we used to rely too much on the severity ratings provided by the vendors,” says Eric Guerrino, senior vice president and head of information security for Bank of New York.

At Bank of New York, the infosec team takes alerts and reports from vendors, CERT, the Financial Services ISAC, vulnerability alerting services, the media and other sources of information. “Sometimes, especially on the network, most of the critical patches we’re concerned with need to be rolled out at the edge devices but not necessarily the entire network. So we’ll give it rating of high for servers in the DMZ, and a medium rating for everywhere else,” says Guerrino.

Network administrators at both banks use vulnerability and asset management tools, along with network protocols and network management tools to keep track of devices, services, versions and patch levels.

The key is continuous assessment of your network devices, their versions, and their patch levels. And you need to assign asset value to those systems — for example a financial or health care database is more critical and sensitive than, say, your Web server,” says Abraham Kleinfeld, president and CEO of nCircle, a vulnerability assessment vendor in San Francisco.

“Buying Time” with Firewalls Guerrino and Garique say that their security patching routines have become sane — nearly predictable, except for when the occasional big one hits.

http://www.securityfocus.com/news/9100

According to data compiled by WebSideStory, Internet Explorer’s market share has dropped 1.32 percentage points since June 4, the first marked decay in IE’s leadership since 1998.

“Sometimes these are just spikes,” said Geoff Johnston, an analyst with WebSideStory, “but this has become a very predictable trend.”

Internet Explorer has had more than 95 percent of the browser share for the past two years, and until early June of 2004, had owned about 95.7 percent of the market. Within the last month, however IE’s share of the U.S. browser business fell from 95.48 on June 4 to 94.16 on July 9. Netscape and Mozilla, meanwhile, saw their share climb from 3.54 percent to 4.59.

“The past couple of years, IE’s share has been pretty steady. But this is the first time we’re seeing an actual trend,” said Johnston.

A one-and-a-third point loss may not set alarm bells ringing at Microsoft, but when one considers how many people use the Internet, the number of users switching are significant.

Some analysts estimate the U.S. Internet population at around 200 million. A 1.32 percent change in browsers, then, translates into 2.6 million dropping IE. The slip by IE is also important, said Johnston, simply because it’s so difficult to get people to change browsers. “There’s this huge inertia,” he said, “that keeps them using the same browser.”

Behind the downturn in IE’s share, said Johnston, is the combination of its recent slew of security problems and the appearance of alternatives that are as good, or in some cases better, than Microsoft’s browser. The security problems [of IE] mixed with the launch of excellent alternatives, like Firefox, are what’s finally getting people to switch. They’re thinking, ‘I’m not the only one.’

Like they say, nothing attracts a crowd like a crowd.”

http://www.techweb.com/wire/story/TWB20040712S0003

Spim affects only a small number of people today, but the problem is growing. It accounts for between 5 percent and 8 percent of all business IM communications, according to The Yankee Group. According to data from Radicati Group, 400 million spim messages were sent in 2003. That number is likely to jump to 1.5 billion at the end of 2004, representing a growth rate triple that of traditional e-mail spam.”

More info: http://news.com.com/2100-1032_3-5228678.html

Security spending takes up from 3 percent to 4 percent of IT budgets today, the Meta Group said in a report on calculating information-security spending.

A chief financial officer typically defines ROI as dollars spent balanced by additional revenue or accrued profit, but “security doesn’t generate revenue or improve profits in a predictable manner,” Meta analyst Chris Byrnes said.

The rate of spending is expected to be slower in Europe than in the U.S., with a 5 percent to 7 percent CAGR versus a 10 percent CAGR, Meta said.

The major reasons are the lower intensity of publicity regarding cyber-crime and compliance issues.

In the Asia-Pacific region, spending rates are expected to be similar to Europe in mature economies, such as Singapore, Japan, Australia, and South Korea.

Security spending in developing countries, such as Malaysia, Thailand, and Philippines, is only starting.

Within verticals, the more regulated industries and those that conduct a lot of electronic financial transactions over the public Internet are expected to continue spending more on security.

More info: http://www.techweb.com/wire/story/TWB20040607S0013

In the class-action litigation brought by families of Sept. 11th victims against the airlines, airport security companies, airplane manufacturers and the owners and operators of the World Trade Center, the court examined two main elements:1.

Whether the various defendants owed a duty of care to the people in the World Trade Center and on the planes that crashed; and 2. In finding that the case should go to a jury, the court stated that we impose a duty on a company when the relationship between the company and user requires the company to protect the user from the conduct of others. This duty of care extends to private companies.

But the court also made a revolutionary declaration with respect to foreseeability. The court stated that, typically, a criminal act (such as terrorism or hacking) severs the liability of the defendant, but that doctrine has no application when the terrorism or hacking is reasonably foreseeable. The court went on to note that the danger of a plane crashing if unauthorized individuals invaded the cockpit was a risk that the defendant plane manufacturer should reasonably have foreseen—indicating that terrorist acts are indeed foreseeable.

A second case involved Verizon and the Maine Public Utilities Commission. The case dealt with whether Verizon could get a waiver for certain performance failure penalties that it was required to pay. Verizon argued that it should not have to pay, since its website went down due to the Slammer worm. The commission found that viruses and worms are foreseeable events, as evidenced by the regular security bulletins issued by software companies. The commission found that Verizon had not taken the reasonable steps available to it; steps that competitors AT&T and WorldCom did take (installing patches to ward against Slammer). Ultimately, the commission found that Verizon should be held accountable for its failure, indicating that virus attacks are also completely foreseeable events.

So now that threats to technology and other systems are no longer considered unforeseeable, what is a conscientious CSO to do? They must be able to prove they use best practices with respect to policies for information management, security, implementation of those policies and disaster recovery plans.

More info: http://www.csoonline.com/read/050104/flashpoint.html

According to security firm NTA Monitor, UK businesses are drowning under a rising tide of medium and low-level security vulnerabilities as they fight to deal with high-risk security flaws.

The company’s research – based on analysis of almost 500 network perimeter security tests of clients in both the public and private sector – found that a third of corporate networks have at least 10 flaws, opening themselves to “considerable risk of malicious attack”.

High-risk flaws were discovered in only 3.9 per cent of tests, while medium flaws were found in 74.3 per cent of tests and a low-risk vulnerability of some kind was found in every test carried out.

Security issues relating to the configuration of internet routers were found to account for the most frequently identified vulnerability.

Poorly configured routers can allow an attacker to let themselves into a network and can also be used as a stepping stone to attack other systems, NTA Monitor warned.

The most common problem the security firm found threatening its customers was denial of service (DoS) attacks.

Low-level flaws were identified in all networks in both 2003 and 2004, while medium-level flaws climbed from 73 per cent in 2003 to 74.3 per cent in 2004.

http://www.vnunet.com/News/1155120