Category: News

During a panel discussion about the possibility of government creating cybersecurity regulations, Press and Rich Mogull, a research director for Gartner Research, advocated government taking a more active role.

While others on the panel suggested the U.S. government could affect cybersecurity by using its huge purchasing power to influence companies, Press questioned why software vendors aren’t sued for selling products with security flaws. Without laws allowing software vendors to be sued, “you are rewarding people for selling broken products,” he added. Instead of software vendors being held responsible for cybersecurity problems, the buyers pay the bill, Press said. Instead of government regulations, software buyers should demand better products, he said. In all but the desktop market, where Microsoft dominates, competition over the past couple of years has helped improve software security, Pescatore added.

Fred Barnes, executive editor of the conservative Weekly Standard and cohost of Fox News’ Beltway Boys, asked the panel why more cybersecurity legislation hasn’t been considered in the U.S. Congress.

“There’s a fear of stifling innovation,” said Roger Cressey, president of Good Harbor Consulting LLC and former counterterrorism expert at the White House.

Fred Barnes, executive editor of the conservative Weekly Standard and cohost of Fox News’ Beltway Boys noted that some government and private cybersecurity experts have been warning of the possibility of a “digital Pearl Harbor,” a massive attack on U.S. IT assets, for several years. The threat cannot be overstated, answered Bob Dix, staff director for the technology and information policy subcommittee of the House Government Reform Committee. However, Dix said Monday he hopes the subcommittee’s efforts to raise awareness about cybersecurity will get company chief executives to take the issue seriously.

But Press suggested that the software industry should be proactive and work with Congress now to pass legislation the industry can live with.

More info: http://www.nwfusion.com/news/2004/0607cybertooi.html

Software companies must add additional controls to the development process for software produced outside the U.S., said Steve Solomon, chief executive officer of the Dallas, Texas-based Citadel.

“Software development organizations should be required to have all overseas-developed software examined for malicious capabilities embedded in the code,” Solomon told the House Government Reform Committee’s Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census.

Much of the hearing, which lasted more than two hours, was devoted to government agencies detailing their cybersecurity efforts, but Solomon’s comments drew disagreement from Microsoft Corp. and Juniper Networks Inc. representatives.

Subcommittee chairman Adam Putnam, a Florida Republican, focused some of his questions on the patching process after software vulnerabilties are discovered. Asked by Putnam if the patching process and the alert process that accompanies it is working well, Scott Culp, senior security strategist for Microsoft, said he believes software vendors are working hard to notify government and private customers. “I remain concerned that we are collectively not moving fast enough to protect the American people and the U.S. economy from the very real threats that exist today …

Solomon also suggested that companies that rely on patch management services have “false security” because they are missing larger problems, such as the lack of broad security policies and recovery after attacks.

Incentives such as tax breaks, cybersecurity insurance and lawsuit reform could help software companies make more secure products, Rosenthal added.

Meanwhile, the U.S. Department of Homeland Security (DHS) is working with private companies to pump up the programs offered by US-CERT, the government’s computer emergency readiness team, said Amit Yoran, director of the National Cyber Security Division at DHS. US-CERT launched a national cyber alert system in January, and around mid-year it plans to roll out a partner program to encourage private companies and universities to work with government agencies. Goals of the partner program include the better sharing of information on cyber threats, improving cyber response and increasing discussion about cybersecurity, Yoran said.

More info: http://www.infoworld.com/article/04/06/02/HNoffshorecheck_1.html

Representatives at the Cupertino, Calif.-based company were quick to point out that the threat was merely a so-called proof-of-concept virus–a worm developed by someone to show that vulnerabilities are present in a particular type of system–and not a virus already spreading in the wild.

However, Oliver Friedrichs, senior manager of Symantec’s Security Response Team, said W64.Rugrat.3344 can attack 64-bit Microsoft Windows files successfully. He said the virus does not infect 32-bit files and will not run on 32-bit Windows systems. Since 64-bit systems have yet to proliferate widely, Symantec maintains that the virus does not yet represent a serious threat. “We always see early adopters trying to find a way to attack new technology right away, as we did with 32-bit, so it’s not surprising to see this,” Friedrichs said. “But we do expect to see more of these, as 64-bit technology becomes more prominent.”

The 64-bit market is expected to grow rapidly. By the end of next year, most Intel chips, will be 64-bit capable, and virtually all of rival Advanced Micro Devices’ processors will be 64-bit chips. Software titan Microsoft is also pushing the high-end market forward. Earlier this month, Chairman Bill Gates asked hardware makers to start writing 64-bit drivers for their software.

Among the advantages of 64-bit software is the ability to gracefully accommodate more physical memory than the 4GB limit in 32-bit systems.

Symantec said it was not expecting widespread copycats of W64.Rugrat.3344, since the affected assembly code requires fairly advanced technical knowledge. Symantec said W64.Rugrat.3344 was created in IA64 (Intel Architecture) assembly code and infects IA64 executable files, excluding .dll files. The security specialists reported that W64.Rugrat.3344 also infects files that are in the same folder as the virus, as well as all files within related subfolders.

Symantec is currently updating its Norton AntiVirus product line to protect against W64.Rugrat.3344 and expects to have versions of the software armed to defeat the virus ready by the end of the day Thursday. The company earmarked the 64-bit virus as a Level 1, or the least dangerous sort of threat ranked on its five-tiered ratings system, but warned users to update their virus protection systems as quickly as possible.

The company earmarked the 64-bit virus as a Level 1, or the least dangerous sort of threat ranked on its five-tiered ratings system, but warned users to update their virus protection systems as quickly as possible.

More info: http://zdnet.com.com/2100-1105_2-5221949.html?tag=adnews

Microsoft said on Tuesday that it had agreed to combine its Caller ID efforts with the SPF, a specification crafted by Pobox.com Chief Technology Officer Meng Wong.

A recent crop focuses on the idea that ISPs could publish the range of Internet Protocol addresses associated with their e-mail domains. If there’s no match, the recipient’s ISP can safely assume that the message is spam–or at least fraudulently addressed. The combined SPF and Caller ID, which has yet to be named, will use XML (Extensible Markup Language) to let Net service providers post IP addresses in the Domain Name System, the giant database that translates alphanumeric domain names like “news.com” into numerical IP addresses for Web servers.

“The convergence of the two proposals is a very positive milestone in the war on spam and brings together the best of both SPF and Caller ID,” said Microsoft spokesman Sean Sundwall. AOL, which in December began testing SPF, hailed Microsoft’s collaboration with Wong. “We welcome Microsoft to the position we have long held concerning the attributes of SPF,” AOL spokesman Nicholas Graham said. “And on the need for a joint standard that is about more than one technical standard, one technology or one company. We were the first ISP to agree to test and implement SPF, back in December, and we think this convergence is the right approach at the right time.”

Other systems for authenticating mail are also in progress. Sendmail and Yahoo have gotten behind DomainKeys, which authenticates e-mail through digital signatures and is not mutually exclusive with DNS-based systems.

More info: http://zdnet.com.com/2100-1104_2-5220253.html

The technology, which won’t be available until the software giant releases Windows Server 2003 R2 in the second half of 2005, will interoperate with other companies’ identity management software, said Michael Stephenson, lead program manager for Windows Server 2003. “Federated identity lets companies securely extend their applications to suppliers and external users,” he said.

Though the software the company plans to show off won’t be available anytime soon, Stephenson wanted to underscore that Microsoft is playing well with others: “We have been working closely with others in the industry on interoperability.” Microsoft’s interoperability demonstration is the latest move in the software giant’s plans to push for the ubiquitous use of identity management and Web services.

Along with IBM, the company has been a cheerleader for the adoption of the Web Services standard by the Organization for the Advancement of Structured Information Standards, or OASIS.

WS-Security, which includes many of the federated identity specifications, passed muster in April. The Web Services framework competes to some extent with the E-Business Extensible Markup Language (ebXML), which has also been adopted by OASIS.

Both sets of services aim to allow Web sites to offer services to other e-commerce sites.

However, to share identity between sites on the Web and between servers inside a company only three options currently exist: the security assertion markup language (SAML) 1.1, the WS-Security standard or the Liberty Alliance’s standard, which has become the base for the next version of SAML, 2.0. Such identity services promise to allow partners to share secure access to services by letting a person who signs in to one server access any other partner’s server without having to sign in.

Originally, Microsoft had hoped that its Passport service would be the single-stop place for people to store their information on the Web. However, businesses and consumers did not agree, and so the software giant started to work on federated services. While Microsoft played well with its partners, the software giant and the Liberty Alliance are still at odds. Microsoft and the Liberty Alliance have still not committed to supporting each others’ standards. Stephenson said he is “very hopeful” that the two will work together.

The Liberty Alliance boasted on Monday that it offers the most mature method for sharing identity information. “The WS family of specifications in general, with the exception of WS-Security, are not in any usable standards form,” said Michael Barrett, vice president of privacy and security for American Express and president of Liberty Alliance’s management board.

More info: http://news.com.com/Microsoft+to+show+off+ID+federation/2100-7347_3-5219584.html?part=rss&tag=feed&subj=news

As the adoption of wireless technology continues to grow among businesses and home users, two key improvements in the security and performance quality of Wi-Fi devices are set to reach wireless network users later this year.

The 802.11i standard is the complete version of the preliminary WPA (Wi-Fi Protected Access) security standard introduced last year, while 802.11e is a new standard that will improve the quality of wireless networks that transmit voice and video.

Security has been one of the biggest obstacles to the growth of wireless networking. Last year, WPA replaced the flawed WEP (Wired Equivalent Privacy) protocol to shore up wireless security before the full 802.11i standard could be ratified. WPA uses a dynamic encryption key as opposed to the static key used by WEP, and it also improves the user authentication process.

The 802.11i standard adds Advanced Encryption Standard technology, a stronger level of security than that used in WPA.

Enterprises and governments, which need the highest level of security available, may have to replace some of their networking equipment in order to support the AES standard.

Newer networking equipment released within the last three months will probably have enough computational power to handle the increased performance requirements of AES security, Hanzlik said. Network managers with older wireless devices should check with their vendors to see if that equipment will support a software download of the full 802.11i standard, he said. Companies with older networking equipment must decide whether the data traveling over their wireless networks is critical enough to warrant a significant upgrade, said Aaron Vance, a senior analyst at Synergy Research Inc. in Scottsdale, Ariz. In many cases, third-party products that can secure a wireless network when combined with the WPA standard are available, he said.

http://www.computerworld.com/mobiletopics/mobile/wifi/story/0,10801,92906,00.html