Category: News

The unnamed technology — Xerox refers to it as a categorizing tool — is available now, and can be licensed by enterprises that want to incorporate it into existing document systems, as well as by third-party software vendors in the document management, customer relationship management, and information retrieval markets, said Xerox.

The Xerox tool, said Eric Gaussier, a researcher at the Grenoble facility, uses a hierarchical model able to understand the dependency between multiple categories, unlike so-called “flat” search and retrieval tools which treat each category separately.

More info: http://www.techweb.com/wire/story/TWB20040226S0008

Introduced at security software maker RSA’s ongoing conference in San Francisco, the group has been christened the Cyber Security Industry Alliance (CSIA) and will be headed by Paul Kurtz, a former special assistant to the president who has worked on technology issues for the White House’s Homeland Security Council.

Among the 12 companies represented in the organization are security specialists such as Check Point Software, Computer Associates International, Entrust, Internet Security Systems, Network Associates, Symantec and RSA. The overriding goal of CSIA would be to gather input from leading cybersecurity providers and create initiatives for proposals to fellow technology vendors and government regulators alike. The group will be broken up into four committees that address the association’s major areas of interest.

Although Microsoft and other information technology leaders were not asked to be directly involved with the organization, Kurtz said it would be critical to generate participation from such companies in order to gain support for CSIA measures.

More info: http://zdnet.com.com/2100-1105_2-5165204.html

The pair, both software-based, include Proventia Web Filter, a content filtering package for Web gateways, and Proventia Mail Filter, an anti-spam filtering agent also deployed at the gateway.

Web Filter relies on a database of more than 20 million Web sites and some 2.6 billion individual pages, all categorized under labels such as online shopping and erotic content. Companies use this database, and a set of customizable rules, to define what their employees can access, when they can surf to sites, and the enforcement actions taken if workers try to reach forbidden content.

Both packages are available now under Cobion’s OrangeBox brand, and will ship under ISS’s own Proventia brand name in the second quarter.

ISS also plans to wrap the new software into hardware-based appliances — its Proventia family is primarily appliance-based — in the second quarter of 2004.

More info: http://www.techweb.com/wire/story/TWB20040225S0007

A little-known and perhaps largely outdated auditing standard for outsourcers could be the next big hurdle for Sarbanes-Oxley compliance. The standard in question is Statement on Auditing Standards No. 70, “Reports on the Processing of Transactions by Service Organizations.” Set up by the American Institute of Certified Public Accountants in 1993, SAS 70 spells out how an external auditor should assess the internal controls of an outsourcing service provider and issue an attestation report to outside parties or to a client.

Auditors and other critics of the standard say SAS 70 is in need of a major overhaul, especially considering the June deadline for Section 404 compliance facing many public companies.

Stan Lepeak, vice president of the research firm Meta Group, believes that incompatibilities between SAS 70 and Sarbanes-Oxley will “dampen outsourcing, at least in the short run, until outsourcers can show that they have both the adequate controls in place [and] evidence to prove that.” Tom Eubanks, of IBM business consulting services, isn’t so sure. “On first blush,” he says, “one might think, ‘Why would you outsource in a world where Sarbox is in place…and the magnifying glass is on the finance function?’ ” But what Eubanks and his colleagues are finding, he adds, is that “companies are looking at outsourcing as a valid way to address some [Sarbanes-Oxley] issues.”

All in the Timing Under SAS 70, an outsourcing-service provider undergoes an annual audit, performed either by its own independent auditor or by the auditors of its outsourcing clients. There are two types of service-auditor reports.

Type I includes the service auditor’s opinion on the fairness of the presentation of the provider’s description of its controls and how well they’re designed to meet specified control objectives.

Type II reports, generally preferred for their greater depth, include the same data as Type I as well as the auditor’s opinion on the effectiveness of the controls during the period under review.

More info: http://www.cfo.com/article/1,5309,12161|0|C|1|,00.html

Hewlett-Packard Co. plans to unveil two new security services next week at the RSA Conference in San Francisco, both of which are designed to help customers resist potential and ongoing attacks.

HP’s new Active Countermeasures service will be a two-tiered vulnerability assessment that pulls in data on new threats from the CERT Coordination Center, ISA and other sources. The system will rank the threats according to their probability of exploitation and risk, then perform scheduled scans of the customer network, searching for machines that are vulnerable to any of the high-risk threats. HP will write its own exploits for new flaws and then use the code to access each machine and install the patch.

HP’s other new offering is called the Virus Throttler, and is designed to limit the damage done by viruses and worms after they hit a network.

http://www.eweek.com/article2/0,4149,1533447,00.asp?kc=EWRSS03119TX1K0000594

First, the agreeable part: Everyone—the government, industry and consumers—agrees that the government should help protect the critical infrastructure that allows our economy to function, and everyone agrees that particular attention should be directed to the protection of water supplies, power grids and gas lines.

Beyond that point, however, the harmony fades. Industry has two big gripes with the new law. First, a meddlesome federal government could require industry to cough up billions of dollars for security measures that may or may not be needed. And second, industry doesn’t trust the government to keep a secret.

There is, of course, good reason for that: The Freedom of Information Act requires federal agencies to release to the public all documents containing information about public health risks and general safety, and the data demanded by the new act would certainly qualify as such. So it’s not surprising that industry spokespeople have been making a lot noise about the dangers of such information falling into the hands of the wrong people, such as terrorists, not to mention investigative reporters or consumer advocacy groups.

Ever innovative, the DHS has found a way to encourage business to share the kind of information that it would not otherwise share: It simply trumped the Freedom of Information Act. The new law now contains a provision that grants the Department of Homeland Security the authority to exempt any information that it deems “protected” from the reaches of FOIA. That provision, of course, is making consumer advocates and environmentalists crazy. They point out that the law creates a convenient method for industry to bury damaging information about such things as plant safety and environmental hazards. All a polluter has to do, they say, is persuade an industry-friendly DHS that certain information should be “protected,” and that information will be off-limits to journalists, stock holders and even plaintiffs in civil lawsuits.

According to a recent article in The Wall Street Journal, some critics claim that the law could conceivably be used to prosecute whistle-blowers who reveal problems involving any part of a company’s critical infrastructure. The DHS admits that the law is not perfect. If it were, the agency would not be asking the public for comments about it for the next 90 days. But the DHS leaders do want comments. Is there a way to protect the country’s critical infrastructure and keep everybody happy?

http://comment.cio.com/soundoff/021904.html