Category: News

U.S. Trust’s Axelrod would not reveal what forms of endpoint security he uses within his organization, although he explained his back-end storage philosophy. “I believe in data restriction,” he said, explaining that his primary requirement “is to get rid of it as soon as it becomes obsolete.” “We have a branch of the military that we’re working with — they have a 15-character minimum password and you have to change the last 10 characters every 90 days,” said Kevin Gillis, vice president of secure file transfer at vendor Ipswitch.

Other users at the event cited the challenges posed by removable media and laptops, something that’s become a major headache for IT managers and CIOs.

A number of vendors, including SanDisk, Lexar, and Seagate, are currently touting solutions, designed to lock down data on laptops and USB drives, which is quickly catching on with IT managers and CIOs.

In a show of hands at another of today’s panel discussions, around a quarter of the 20-plus audience members confirmed that they are encrypting their laptop hard drives.

http://www.darkreading.com/document.asp?doc_id=127750&WT.svl=news1_2

Log management tools can help organizations drill down and look for specific data strings such as full track data from credit cards; PCI prohibits storage of such information, so companies can then take corrective action. The log management market includes tools from LogLogic, LogRhythm, Splunk, syslog-focused products such as Kiwi Enterprises’ Syslog Daemon and freeware like Unix’s syslog daemon. Also, security information management (SIM) vendors have begun tailoring their product lines to meet the demand for log management by offering options that focus on providing more storage capacity than correlation capability.

At the Burton Group Catalyst Conference, Jay Leek — manager of corporate IT security services at Nokia — plans to talk about practical considerations for log management and how a centralized system can improve compliance, incident response and troubleshooting while also saving time and money. Without any control over what’s being logged, companies can spend a great deal of time and effort searching through log data during an incident investigation or when trying to troubleshoot an IT problem, he said.

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1261647,00.html

The 10 winning contractors are:
* MTM Technologies, with Mobile Armor
* Rocky Mountain Ram, with SafeBoot
* Carahsoft Technology, with Information Security Corp.’s SecretAgent
* Spectrum Systems, with SafeBoot
* SafeNet
* HiTech Services, with Encryption Solutions’ SkyLock
* Autonomic Resources, with WinMagic
* GovBuys, with WinMagic
* Intelligent Decisions, with Credant Mobile Guardian
* Merlin International, with Guardian Edge Technologies

Federal officials are urging commercial industry to follow its lead on encrypting data stored on mobile devices. “Whenever we band together to look for products that raise the bar for security, we’re helping everybody, including our private sector partners,” Wennegren said.

http://seclists.org/isn/2007/Jun/0075.html

Money and investments focused on security and privacy are most often viewed as insurance premiums-to be kept to a minimum consistent with the negative risk experience of each institution. Such spending is certainly not perceived as an investment for winning stakeholders, sustaining excellence or achieving market leadership.

But today’s world, where an increasing majority of institutions do business online using telecommunications networks that span the globe, security and privacy protections expressed in negative terms don’t make the grade. They must adopt an approach based on winning the trust of all stakeholders-customers, employees, channel partners, contractors, vendors and shareholders all.

Trust means stakeholders feel safe in the hands of these enterprises and are confident in the secure delivery of their products and services along with protection of their private information. Given the status of security and privacy today, the CIO is most often anointed as enterprise information security and privacy champion. When stakeholders’ experiences with an institution consistently meet or exceed their expectations, these experiences build awareness, then breed familiarity and finally, earn trust-which inevitably translates into profit.

Amex provided its card members and service establishments with, at the time, a revolutionary new way to do business: They could execute secure and private financial transactions anytime anywhere in the world. The linchpin of this model was and is the magnetic-striped card that identifies and validates individual card members and other authorized stakeholders to use the integrated global network.

A trust-based business model is also a natural extension of enterprises’ commitment to compliance with Sarbanes-Oxley (SOX) regulations and the transparency that results. They need to create incentives for their executive management to create an operating model that earns stakeholders’ trust. Companies will use trust to forge new alliances with stakeholders by guaranteeing secure and private interoperability. And in doing so, companies will define competitive success in a global online real-time marketplace.

http://www.networkworld.com/news/2007/053107-forget-security-and-privacy-focus.html

They think security pros need to worry more about retaining the best staff and should be careful not to become too consumed with regulatory compliance.

Michael Barrett, CISO at eBay money-transfer service PayPal, says there is always an undercurrent of panic in the event that something blows up. “Most data centers are held together by sheer heroic effort,” he says. When Microsoft discloses software vulnerabilities, as it typically does every first Tuesday of the month, “We’re scurrying about to get patched, and I worry: What will the bad guys do before we patch everything?” Because PayPal is a global company, Barrett says he worries whether the company has the right interpretation on legislation and regulation related to data privacy around the world and the right controls in place.

His long-range concerns have him asking questions such as: In terms of stopping criminals and attackers, do we have the right investment mix and the right set of projects? Are new threats coming up that we need to re-balance that portfolio?

At motion-picture processing and games-manufacturing studio Technicolor in Camarillo, Calif., whose clients include DreamWorks SKG, Sony Pictures Entertainment and Paramount, the top worry is attackers who might steal the entertainment content.

Risk management can sound like a “Mission Impossible” episode in large organizations with many lines of business, tens of thousands of employees, and lots of applications and networks to keep an eye on. “I’m always on call,” says Jalal Zamanali, senior vice president of IT and CISO at Temple-Inland in Austin, Texas, and its subsidiary Guaranty Financial Services, with combined interests in corrugated packaging, forestry, real estate and financial services. Although he has a security staff of 17 to stay abreast of IT projects, Zamanali says his top concern is making sure security controls are on track in terms of regulatory compliance rules related to the Sarbanes-Oxley and Gramm-Leach-Bliley laws. “The chief audit officer has to translate these laws into control points,” Zamanali explains. Consequently, Zamanali — who reports to the chief risk officer — makes sure he meets with the chief audit officer about once a week to discuss compliance issues.

Beth Cannon, CSO at merchant bank Thomas Weisel Partners in San Francisco, says audits to provide evidence that security policies are enforced in IT systems and processes are her main worry.

Consultants and other industry experts don’t dismiss the issues that CSOs and CISOs are worrying about, though they recommend a host of things that might warrant even more of security professionals’ attention. CSOs should worry about losing their jobs because all too often their stance on security is seen by upper management as overly technical or a bad fit, says Jon Gossels, president and CEO of consultancy SystemExperts in Boston. Brad Johnson, vice president at SystemExperts, say one key worry that CSOs should have is where and how they’re going to find and retain the best security-savvy employees.

The Palm Harbor, Fla.-based professional organization International Information Systems Security Certification Consortium (ISC2) has had 48,000 security professionals pass its exam for Certified Information Systems Security Professional and other certifications that can often be found listed on the business cards and resumes of CSOs and CISOs.

Zeitler, whose 30-year career included positions as CISO at Volkswagen Credit and head of security at Charles Schwab and Fidelity Investments, says a top concern for CSOs should be whether they can find personnel with the right skills at the right price. He points to computer forensics, which requires people trained in procedures to capture potential evidence and preserve it appropriately, as an example.

Howard Schmidt, the former security chief at eBay and Microsoft and former White House cybersecurity advisor, says there’s no doubt that regulatory-compliance issues are going to be a top worry for the CSO or CISO.

http://www.computerworld.com.sg/ShowPage.aspx?pagetype=2&articleid=5254&pubid=3&tab=Home&issueid=112

“Web 2.0 is all about openness and freedom,” said Kris Lamb, a director with IBM’s Internet Security Systems, in an interview at Interop.

As companies rush to embrace this trendy new media phenomenon, IT and security managers are being warned to slow down the process and make sure they think through their security.

Web 2.0 technologies — the kinds that promote interactivity and community-building and made MySpace and YouTube household names — are starting to gain a foothold on more conventional Web sites. An automobile maker, for instance, might start a social network or blog for customers to write about their experiences with their vehicles or to post pictures or videos from their favorite road trips.

But the advantages of creating these communities and enriched Web sites also come with the same risks that plague the Web 2.0 giants. Hackers and spammers can join MySpace to create their own pages, riddled with malicious code, to infect their social-networking peers. And hackers are beginning to target vulnerabilities in Ajax applications, which help make the Web 2.0 Web sites so dynamic.

“It’s a gold rush right now,” said David Cole, director of Symantec Security Response, in an interview at Interop.

Paul Judge, chief technology officer at Secure Computing, said in an interview that many companies are still getting their arms around traditional Web site issues, including database validation problems, and now they’re being hit with unfamiliar technologies.

Symantec ‘s Cole said IT managers need to make sure they take enough time to plan out the necessary safeguards before they jump into Web 2.0 technologies. Make sure that users aren’t allowed to use JavaScript, and assume that spammers will find the site — so set up protections and caution users from putting up too much personally identifying information, especially e-mail addresses.

http://www.darkreading.com/document.asp?doc_id=124871&WT.svl=cmpnews2_3