Category: News

Commercial websites are very much on their own when it comes to protecting themselves against a flood of traffic that can deliberately knock their business offline for days at a time during a distributed denial of service, or DDoS, attack.

What ISPs currently offer as standard is stone-age in terms of sophistication and more centred on protecting the ISP’s network than cleaning out DDoS traffic and ensuring that legitimate traffic reaches the affected sites.

DDoS attacks are not a problem at the core, where we have acres of bandwidth, but as it gets out to the edge, where the routers and switching hardware is less substantial, then it can be quite damaging. ACLs, or Access Control Lists, summarily block access to the network from ranges of IP addresses containing DDoS traffic, or to the target URL. But this blanket approach makes no allowance for legitimate traffic, and partially accomplishes the DDoS attackers’ goal, in rendering the target site unavailable or unusable. Neither the ISP or victim are satisfied with the results.

One online gambling site, for example, uses DDoS mitigation specialist Prolexic to direct traffic through its datacentres when under attack. It’s expensive, but not as expensive as losing literally millions of pounds in unplaced bets if – over a key sporting weekend – the site is taken down by an attack. It’s a gamble they can’t afford to lose. Chris Tolson, Infrastructure Manager at a large online gambling company, said: ‘We would struggle to handle with our current bandwidth constraints and the hardware we have in place to fight an attack. It is vital that legitimate traffic continues to come through to our website even while we’re under attack and we do not know of anyone other than Prolexic who can ensure this with today’s increasingly strong and tenacious attacks,’ he added.

Keith Laslop, president of Prolexic said: ‘I’ve seen them on forums where you can hire bots for next to nothing.

http://www.pcpro.co.uk/security/news/98815/bt-to-make-ddos-mitigation-affordable.html

“SMEs have to realize that just because they are small, it doesn’t mean they won’t be targeted. Bad guys target wherever they can get money. Individuals working on peer-to-peer networks often don’t realize they’re sharing the whole contents of their drive. You can find Homeland Security vulnerability assessment documents online from employees (using P2P).”

However, Schmidt said that SMEs will eventually start using managed software security services, with third-party providers managing both low-cost application level security and end-point hardware. They want automatically self-healing and self-configuring software,” said Schmidt.

Small businesses must take security into account in their planning and decide whether to outsource security, invest in training or allocate more resources. If a small enterprise does have a full-time IT manager, that manager should become familiar with security standards such as ISO 17799, he said.

McMurdie said that computer security should follow common-sense procedures.

http://news.com.com/Small+companies+ignorant+of+security/2100-7355_3-6137381.html?tag=ne.fd.mnbc

But Ted Julian, vice president of marketing for AppSec, which sells vulnerability scanning tools for databases, says the lopsided vulnerability count may be more a function of where the more valuable corporate data typically lies — in the Oracle database. “I see plenty of companies that have confidential data in SQL Server, Oracle, DB2 and Sybase. It is certainly not as if it all sits on Oracle,” he says.

But either way you slice it, hacking a database is like striking gold, whether it’s via a Web app or database bug — or both. “If you can break into a Web application, you can get access to the database using the same application,” Friedrichs says.

And you can’t count on that firewalled DMZ to protect your database anymore: Databases are most at risk to an insider threat, ESG’s Ogren says, and these attacks don’t typically use vulnerabilities at all.

http://www.darkreading.com/document.asp?doc_id=110881&WT.svl=news2_3

“There has been a lot of spending on network security, but the perception is there is not a lot of risk in that area,” says Forrester senior analyst Tim Sheedy. Sheedy claims that in a few years IT security will be measured much like other business metrics. Businesses will be able to factor in the actual information security risk, based on factors such as employee behaviour, system readiness and the financial ramifications of employees who expose an organization’s most sensitive information — either willingly or by accident. “Putting actual metrics — and particularly financial metrics — around security is going to be a major trend,” Sheedy said.

By 2010, says Pullen, industries like retail, construction and finished goods will have to deal with the same online nasties that plague online banking today — and most won’t be ready.

“In 37 months time I think there will be a public company either forced into chapter 11 (US bankruptcy code) or forced into bankruptcy in Australia because of a security breach that either resulted in goods being stolen from them or an incident with such an impact a company is forced to shut down,” he said.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9005164&taxonomyId=17&intsrc=kc_feat&WT.svl=bestoftheweb1

The most recent movement comes from BT Group, global provider of communications solutions and managed services, which announced that it acquired Counterpane Internet Security, a provider of managed network security services.

In late September 2006, SecureWorks and LURHQ merged under the SecureWorks name.

In late August, IBM announced that it had reached a deal to acquire Internet Security Systems (ISS) for $1.3 billion in cash.

If Perimeter wants to be acquired, its own recent acquisitions make it ripe for that possibility. SurfControl announced two new managed security services offerings for Web and email protection. The merger and acquisition trends fit with industry analyst projections for increasing interest in the overall managed services sector.

http://www.windowsitpro.com/WindowsSecurity/Article/ArticleID/94176/WindowsSecurity_94176.html

Blum will talk about this and other security trends in his “Security Landscape: Market in Flux” session on Monday at the Computer Security Institute’s 33rd Annual Conference and Expo in Orlando, Fla.

This integration is also expected to simplify security oversight, with fewer tools and easier management of all that data they generate. “If you had one vendor provide everything for you, then it wouldn’t [be able to easily] keep up with change and new attacks,” he says. “And if you have too many different vendors’ products, you can’t keep up with the burden of integrating” it all and you’re probably not getting the best bang for your buck because you’ll also have to invest in integrating the tools.

The key is not getting trapped on a treadmill of having to buy a new security tool every time a new attack vector is discovered, or a new compliance requirement comes along, he says.

Meanwhile, there’s still no easy way to manage — nor sift through the false alarms — the data security tools generate. Today’s network operations centers don’t typically encompass all of an organization’s security management, “Most of us don’t have security in the NOC. You see security teams playing more strategic roles than operations, such as compliance, high-level risk management, etc. And they need to be able to exert control through distributed points as well… You can’t do it all from one NOC.”

http://www.darkreading.com/document.asp?doc_id=109786&WT.svl=news1_3