Category: News

The data-security problem reached a new level in June when it was disclosed that a security breach at payment processor CardSystems Solutions Inc. had led to the exposure of 40 million card accounts.

Citigroup has said it would encrypt all tapes bound for transit, while Bank of America improved its tape-tracking procedures and launched a system intended to thwart phishing.

“A day doesn’t go by where information security isn’t front and center,” says Katherine Busser, CIO of the U.S. card division at Capital One Financial Corp.

Banks, insurance companies, and investment firms will spend $362 billion worldwide this year on IT, according to research firm TowerGroup. Other IT priorities in financial services are profitability management and improving revenue streams using technology, according to research firm Financial Insights.

http://www.informationweek.com/showArticle.jhtml;jsessionid=JXRN20RYC05RQQSNDBECKH0CJUMEKJVN?articleID=170703276

Spam filtering is the major focus of any messaging security strategy.

While small companies on average spend 29.5 hours per week per 1,000 users to manage E-mail security, 9.1 hours per week per 1,000 users are spent combating unsolicited messages. Larger companies on average spend 15.2 hours per week per 1,000 users on messaging security, with 4.1 hours per week devoted to anti-spam management, according to Osterman Research. Yet, effective administration of messaging systems requires more than anti-spam management.

The research firm’s Messaging Security Market Trends 2005-2008 study finds that businesses face a myriad of messaging problems.
– Of the 115 companies surveyed, two-thirds struggle to provide adequate storage for E-messages.
– An equal number have inadequate E-mail archiving.
– Two in five say large E-mail attachments are taxing their messaging capability.
– Most alarming, nearly all surveyed companies have had their networks successfully penetrated by a virus, worm, or other form of malware through E-mail.
– Half the sites report employees sending or receiving inappropriate content electronically, while 40% have had staff view inappropriate content. E-mail bandwidth has been clogged at a third of sites because of employees oversubscribing to E-newsletters or mailing lists.
– Nearly half of all companies say employees have E-mailed or instant messaged confidential data, while nearly 20% have been infiltrated by a virus or related threat via IM.

Antivirus and anti-spam initiatives are the basis of any messaging security strategy. But content filtering for outbound E-mail and methods to monitor IM are lacking. Of the 115 companies Osterman Research surveyed, 43% don’t monitor the content of E-mails sent by employees, and three in five don’t monitor IM.

http://www.informationweek.com/showArticle.jhtml;jsessionid=KK01LHWEU4STQQSNDBCSKH0CJUMEKJVN?articleID=170702044

Therefore, monitoring and storing this mountain of content can easily seem like an overwhelming project to begin and maintain for corporations and banks alike. While it is has long been accepted that an employee’s corporate e-mail account is not protected under personal property laws, I do not believe that employees ever thought that their everyday banter would ever be neatly filed pending the possibility of future reference. Sarbanes Oxley (SOX) regulations may cause security auditors and data management professionals to move even the ever popular one-line emails to the filing cabinet.

This is because although emails are informal in nature, electronic documents are as legally binding as hard copy communications. Already, the Securities and Exchange Commission (SEC) requires all private brokerage houses and banks to save hard copy, email, and instant messenger communications in regard to any stock trade or investment which occurred within the past 3 years. This SEC retention of records statute (section 17a-4) has been continuously adjusted, added too, and enforced since 1939. These regulations were originally established to help assure that brokers did not raise their commission rates or become involved in investment fraud.

This need was stemmed by notable court cases such as Morgan Stanley V. Ronald Perelman (Revlon), a case which has already pushed Morgan Stanley ahead of the curve in saving all of their communications, and cost them somewhere in the ballpark of 1.45 billion dollars. Morgan Stanley is now leading the way in these practices in hope of avoiding further litigation and fines for not having proper email retention policies in place. Many entities are looking for the most cost effective services possible when beginning this process and this search has pointed towards hierarchical storage management services.

http://bankinfosecurity.com/node/2570

“Traditional firewall technologies can complicate several aspects of VoIP, most notably dynamic port trafficking and Network Address Translation (NAT) transversal,” says Victoria Fodale, In-Stat analyst.

“Security product vendors are adding functions that address voice applications in their products, but, as history has shown, security typically lags behind advances in technology.”

http://www.ebcvg.com/articles.php?id=876

Police now believe that the company’s 26-year-old head of data security in Helsinki stole banking software from the company along with passwords for its bank account. Accomplices then accessed the account from a laptop computer using an unprotected network at a nearby apartment building in Helsinki’s Kallio district. Suspicion initially fell on the owner of the Wi-Fi network until police searched his apartment and determined he was not involved. They then deduced from the laptop’s MAC address that it belonged to GE Money, and fingers started to point toward the bank’s security officer.

“After a while there were too many leads pointing against him, and after we found the laptop, that was it,” said Jukkapekka Risu, investigating officer for the Helsinki police.

The case was picked up by television news programs in Finland and caused something of a buzz. It also prompted the Finnish Communications Regulatory Authority to remind citizens this week about the dangers of not securing their wireless networks. Wi-Fi is starting to become popular in Finland, particularly among home users. The agency advised people to employ at least the standard WEP (Wired Equivalent Privacy) encryption.

http://www.pcadvisor.co.uk/index.cfm?go=news.view&news=4986

At Colby-Sawyer College in New London, New Hampshire, almost 1,000 students will arrive on campus this week, most with one or more computers in tow. The influx will more than double the number of systems on the campus network, which operates 50 or 60 Windows and Linux servers and around 650 desktops to support administration and other college employees, said Scott Brown, an information security analyst. All students are provided and required to install free copies of NOD32, a desktop antivirus software product from ESET Software and with Webroot Software Inc.’s Spy Sweeper antispyware software before they connect to the campus network.

To enforce that policy, Brown and his colleagues are using Campus Manager, a product from Bradford Networks Inc. that tracks student computers using their unique MAC (Media Access Control) address. Students who attempt to connect to the campus network are directed by Campus Manager to a virtual LAN where they can install the ESET Software and Webroot Software.

Colby-Sawyer also removes existing antivirus and antispam software from the student computers and connects the system to Microsoft’s Web site to obtain the latest Windows operating system patches, Brown said.

Before giving students access to campus resources, Colby-Sawyer also uses a new CAT (client assessment tool) that scans the student computers and verifies that antivirus and spyware definitions, as well as Windows patches are up to date.

The story is similar at Cornell University, in Ithaca, New York, where network administrators used home-grown technology to quarantine systems belonging to about 6,500 students who arrived on campus last week.

http://www.eweek.com/article2/0,1759,1852852,00.asp?kc=EWRSS03119TX1K0000594