Category: News

As if Wi-Fi standards are not confusing enough, last week’s addition of four widely used Extensible Authentication Protocol (EAP) types by the Wi-Fi Alliance will make your head spin.

WPA certification will be more confusing than meaningful for enterprise decisions until at least 4Q05, when it becomes mandatory for vendors to pass ‘new’ WPA2 certification.

Additional confusion will undoubtedly result after Cisco and Microsoft likely introduce a new or enhanced EAP type in coming months which will require the Wi-Fi Alliance to conduct further interoperability testing, according to Gartner.

And the Wi-Fi Alliance is reserving the term “WPA3” for new IEEE 802.11 security features rather than for security testing extensions, further contributing to the confusion around WPA and WPA2 certification through at least the first half of next year.

Gartner says to simply select the authentication approach that best meets matches your business, IT and security processes, regardless of Wi-Fi certification.

http://blogs.zdnet.com/Research/index.php?p=152

Anthony Nadalin, chief security architect for IBM’s Software Group, said IBM is looking to do more to address the issue of security throughout the application life cycle, starting during the requirements process and going straight through to modeling and deployment. “There is a lot of interest in companies building secure applications and how to guarantee that, so we’re looking at the notion of security in the application life cycle.”

Nadalin said IBM is considering enhancing its modeling capability to enable users to integrate security into the process.

The authentication becomes a policy issue, and “you wind up with a policy-driven model. It is nearly impossible to retrofit,” Murphy said.

http://www.eweek.com/article2/0,1759,1787115,00.asp?kc=EWRSS03119TX1K0000594

That remains the province of specialized organizations such as the Internet Corporation for Assigned Names and Numbers, or ICANN; the Internet Engineering Task Force; the World Wide Web Consortium; and regional address registries. Though Zhao is far too diplomatic to state it directly, the ITU’s increasing interest in the Internet could presage a power struggle between ITU, ICANN, and perhaps even the U.S. government, which retains some oversight authority over ICANN and appears content with the current structure.

“The whole world is looking for a better solution for Internet governance, unwilling to maintain the current situation,” Houlin Zhao, director of the ITU’s Telecommunication Standardization Bureau, said last year. Zhao, a former government official in China’s Ministry of Posts and Telecommunications, has been in his current job since 1999. “Countering spam is just one of many elements of protecting the Internet that include availability during emergencies and supporting public safety and law enforcement officials,” Zhao wrote in December.

Also, he wrote, the ITU “would take care of other work, such as work on Internet exchange points, Internet interconnection charging regimes, and methods to provide authenticated directories that meet national privacy regimes.”

This article documents an interview with Houlin Zhao, director of the ITU’s Telecommunication Standardization Bureau.

http://news.zdnet.com/2100-9588_22-5648953.html

The new Fingerprint Sharing Alliance hopes to help its members, which include British Telecommunications, Cisco Systems, EarthLink, MCI and NTT Communications, more effectively share information on individuals responsible for launching online attacks. Other organizations involved in the collaboration include Asia Netcom, Broadwing Communications, Verizon Dominicana, XO Communications and the University of Pennsylvania.

Members of the Fingerprint Sharing Alliance will automatically send one another data on computer hackers as they observe or experience new attacks. By immediately alerting other communications companies when they’re being threatened, members of the group hope they can more effectively guard against online attacks and infrastructure hacks that cross network boundaries.

Arbor Networks is helping to spearhead the effort. The Lexington, Mass.-based company, which specializes in network threat detection and monitoring tools, will provide the technology used by the group’s members to share emerging attack data. By helping the communications giants rapidly distribute information on hackers, the security company said it can aid in blocking attacks closer to the source.

Mark Sitko, vice president of MCI’s Security Services Product Management group, said the Fingerprint Sharing Alliance will quickly provide an “unparalleled view” into new security threats as they surface around the globe. Sitko also promised that MCI will bring significant antihacking firepower to the table.

At least one industry watcher has also endorsed the group’s efforts. Jim Slaby, senior analyst with Boston-based Yankee Group, said that as online attacks become more sophisticated, industrywide collaboration is becoming a more important tool in stopping criminals. “We’re seeing more technology-savvy criminals trying to make money through denial-of-service extortion schemes,” Slaby said in a statement. “Service providers that are cooperating by sharing attack fingerprints are helping mitigate these threats more quickly and closer to the source, thus making the Internet a more secure place.”

http://news.zdnet.com/2100-1009_22-5642840.html?part=rss&tag=feed&subj=zdnet

The alliance was set up with the aim to generate public awareness and focus on best practices for security and privacy of Internet telephony networks.

The alliance said membership of its technical board had risen to 50, with newer members including a McAfee division, MCI, PricewaterhouseCoopers, Samsung Telecommunications America, Sprint and VeriSign.

Internet telephony, which is unregulated, is becoming popular due to cheap rates. With this popularity have come fears of spam and viruses–a nuisance for Internet users–though there have been no major attacks as of yet on Net telephony.

http://news.zdnet.com/2100-1009_22-5643061.html?tag=zdfd.newsfeed

Users of Windows 2000, Windows XP, and Windows Server 2003 will be able to use it to scan for, download, and install updates and fixes for Windows, Office, Exchange, and SQL Server.

According to Microsoft, each group of users — consumers, small businesses, and enterprises — will use its own interface to the all-in-one update center.

Small- and mid-sized enterprises will use Windows Server Update Services (WSUS), a plug-in to Windows 2000 Server and Windows Server 2003, while enterprises will turn to Systems Management Server 2003, an already-available patching, deployment, and hardware auditing program.

Microsoft said it will add other products from its software stables to the new update service.

http://www.securitypipeline.com/news/159905045