Category: Trends

The focus on security needs to shift from cleaning up after a problem to anticipating potential problems, he said, with automated patch management and better coordination of software and hardware.

“Security needs to move beyond its niche focus,” he said. Otherwise, it will be impossible to keep up, Thompson claimed.

“More than 100 new viruses are identified every week–and 60 new software (problems) every week,” he said. “We saw a 19 percent increase in attack activity in the first half” of 2003.

In the relatively near future, the world will likely see the debut of damaging threats the industry is calling “Warhol” attacks, as they are likely to achieve fame by spreading across the Internet in 15 minutes. “Day Zero” threats, which exploit previously unknown vulnerabilities, will hit without warning, the Symantec CEO added.

Corporations are also taking action to stem attacks, such as creating more homogeneous computing environments or taking part in initiatives such as the Network Admissions Control program to ban insecure mobile devices from corporate networks, announced Tuesday by Cisco Systems.

Thompson stated that a shift to Linux from Microsoft wouldn’t be a sure way to avoid the kind of recent suffering caused by viruses that exploited holes in Microsoft code.

More info: [url=http://zdnet.com.com/2100-1105_2-5109531.html]http://zdnet.com.com/2100-1105_2-5109531.html[/url]

Today, about 40 percent of organizations are well secured, 20 percent are beginning to increase their security expenditures, but a good 40 percent still don’t really get it. “Overall security expenditures have increased by about 10 percent in each of the past three years, and security spending now comprises about 4 percent to 10 percent of a company’s budget,” Byrnes said.

“Companies that were merely secure about five years ago are now looking to do things more efficiently, by remaining secure while cutting costs.”

Ron Moritz, head of eTrust security products for Computer Associates, said one way companies might do this is by looking for security solutions that cover entire networks and can be centrally managed.

But all the panelists agree that such a system requires an organization to have a sound security policy. “If you don’t know what’s going on in your network, you can’t respond.

More info: [url=http://www.internetweek.com/story/showArticle.jhtml?articleID=16101239]http://www.internetweek.com/story/showArticle.jhtml?articleID=16101239[/url]

The survey found that 725 new software flaws in the third quarter of this year, down slightly from 727 found in the second quarter.

However, the 823 new worms and viruses that appeared between July 1 and September represented a 26 percent increase from the previous three months.

“The window of time between vulnerability disclosure and the release of a working exploit continues to shrink, leaving enterprises with even less time to learn about and prevent attacks,” Chris Rouland, vice president of Internet Security Systems’ vulnerability research team, said in a prepared statement.

Security software maker Symantec also pointed to anecdotal evidence that the time was shrinking between the first public mention of details of a software flaw and the release of code exploiting the flaw.

Three serious Internet attacks–MSBlast, MSBlast.D and SoBig.F–struck in August.

The Computer Emergency Response Team (CERT) Coordination Center’s latest report indicates that the number of flaws that will appear in 2003 is likely to be smaller than in 2002.

That’s a first: Between 1999 and 2002, the number of vulnerabilities recorded by CERT roughly doubled every year.

More info: [url=http://news.com.com/2100-7349_3-5108921.html?tag=nefd_top]http://news.com.com/2100-7349_3-5108921.html?tag=nefd_top[/url] and
[url=http://bvlive01.iss.net/issEn/delivery/prdetail.jsp?oid=23118]http://bvlive01.iss.net/issEn/delivery/prdetail.jsp?oid=23118[/url]

The CEO’s primary responsibility is the strategy and direction of the business.
Security should be a concern but CEOs usually have a dozen other things in line ahead of it.

The paramount issue for the CFO is controlling costs. CFOs are not supporters of visions of robust, feature-rich and flexible architectures. Their reason is simple—they cost too much. The CSO must make the CFO understand that centralization of the security vision and spending will ultimately save money. The CSO must also initiate a Net Security Risk (NSR) exercise to calculate the financial risk of avoiding security spending.

The CIO keeps the business systems up and running. CIOs are already battling with the CFO for system budgets. In the wake of that battle, security is squeezed as a “nice to have.” For the CSO to succeed, the CIO must make it clear to the IT professionals that security is a part of all technology and a critical part of their jobs; failing to take this into consideration will lead to immediate termination.

The CTO establishes the technology direction of the company. The CTO, however, should not be in charge of the daily operational responsibilities of the business and should not be tasked with security operations among other technology decisions.

The COO is the battlefield commander responsible for the day-to-day operations of the company. Security adds an additional step to all other business and operational life cycles and thus requires more time, more people and more money, all of which are not central to the COO’s charter. Now there are personal privacy regulations in financial services and health care that make it a legal obligation to secure online information as well.

The CSO is responsible for physical and technology security. The CSO must then communicate this vision across all departments and business units.

More info: [url=http://techupdate.zdnet.com/techupdate/stories/main/global_1000_companies_should_hire_a_chief_security_officer_by_the_end_of_2005.html?tag=tu.fd.sc.link]http://techupdate.zdnet.com/techupdate/stories/main/global_1000_companies_should_hire_a_chief_security_officer_by_the_end_of_2005.html?tag=tu.fd.sc.link[/url]

The comments came during a media round-table session at the Gartner Symposium and IT Expo, which began today in Sydney, Australia.

The director, Rich Mogull, told journalists that despite the incidence of high profile digital attacks, cyber terrorism is a phenomenon that has never occurred.

Even though there were examples of attacks that have physical consequences – they could not be described as terrorist acts, Mogull explained.

Mogull maintains the argument is largely academic – it doesn’t matter who’s attacking an organisation, it should be doing the best it can to protect itself in the first place, whether attacks are coming from criminals or “cyber terrorists”.

Let’s look at protecting ourselves by closing the vulnerabilities we know exist, and protecting ourselves from the attacks that we know exist,” he said.

More info: [url=http://www.silicon.com/management/government/0,39024677,39116842,00.htm?foo=’Cyber%20terrorism’:%20Don’t%20believe%20the%20hype%20says%20Gartner%2011–11]http://www.silicon.com/management/government/0,39024677,39116842,00.htm?foo=’Cyber%20terrorism’:%20Don’t%20believe%20the%20hype%20says%20Gartner%2011–11[/url]

Firewall are seem as an essential part of an overall security strategy. The only other technology or security strategy that was seen to have greater promise was disaster recovery.

“Firewalls are rapidly evolving in their roles, and the boundary between firewalls and other infrastructure elements is becoming blurry,” said Fred Cohen, an information security luminary and an analyst with the Burton Group. For example, special firewalls are needed to screen XML transmissions, which can sail through most firewalls.

No one would argue that a modern company with a network doesn’t need a firewall at the gateway, but there are some differences of opinion over whether personal firewalls are needed.

Cohen does recommend personal firewalls for users who access a network remotely with laptops.

The specialization of firewalls means there will be tradeoffs, Cohen said. There is the tension between the idea of a distributed approach and the idea of a centralized one. “The lack of a clear picture [integrating] intrusion detection, special-purpose filtering devices and other services into infrastructure makes many enterprises hesitant to adopt integrated firewall solutions until the market clarifies,” Cohen said.

More info: [url=http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci936078,00.html]http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci936078,00.html[/url]