Category: News

In 2006, the problem seems hardly any better, with one newspaper company accidentally wrapping people’s Sunday editions with a list of 202,000 subscribers’ social security numbers and Seattle-based Providence Home Services acknowledging that backup tapes containing 365,000 patient records in the states of Washington and Oregon had been stolen from an employee’s car. Over the last decade, while the Internet has boomed and busted, online identity has remained a binary proposition to most businesses: Users either fully identify themselves to a Web site or hide behind an anonymous handle. Because commerce sites believe anonymity means less security, online businesses have increasingly asked customers to more fully identify themselves, a choice highlighted by many companies difficulty in keeping the data safe.

“Often times the topic of the level of authentication to create these models (of commerce) deteriorates into a presumption that there is an extreme choice to be made between true proof of personal identity and anonymity,” said Art Coviello, CEO of RSA Security. Coviello argued that companies should adopt technology that allows consumers to present trusted credentials for specific attributes, such as the visitor to the Web site is over 18 years old.

During the keynote kicking off the conference, Microsoft’s chief software architect Bill Gates told attendees that the company’s next operating system will support just such a system. “You will have different cards: Cards that just give your location, cards that more secure that give your credit card (information), cards that you would protect very carefully and you would have a PIN for every use of it where you might authorize access your medical information.”

Businesses can gain by having less information stored on their servers. Moreover, putting fewer barriers in the way of the customer will mean more business, said Rob Shenk, vice president of online financial giant E*TRADE Bank during a panel on consumer authentication for the financial industry.

http://www.securityfocus.com/news/11377?ref=rss

This prevents organisations from using equipment from several vendors in creating interoperable networks such as a global network of airports using a single database with iris scan information.

Common applications base authentication on finger prints, iris, face and voice and vein scans.

The panel conceeded finger print scanners are readily available with many notebook makers offering such technology as an option with their business models. However, it was argued that availability of hardware was not enough to guarantee adoption of biometrics.

“But just because you have the hardware, that doesn’t mean that each person who uses it will use it in such a way that you get value for the organisation,” warned Samir Nanavati, a partner with Biometric Group (IBG), an independent consultancy organisation.

The technology is mainly struggling to cross over from government applications to the public sector, they argued, as vendors remain primarily focused on selling to governments.

http://www.vnunet.com/2150496

The carriers are optimistic that they can keep the level of spam on mobile communications networks below the level of fixed Internet. Among other things, they believe that it makes a difference that text messages and MMS cost money. In addition, mobile network operators claim that they can keep much better control of their networks than the public Internet. At the same time, mobile communications companies realize the need to work together across networks to put an end to international spammers. They plan to have anti-spam passages put into contracts signed with commercial senders of mass text messages. But the initiative’s call to have laws that “hamper” the fight against spam repealed seems more problematic. Among other things, the carrier would like to do away with the regulations on data protection, such as the privacy of telecommunications. (Craig Morris) / (jk/c’t)

http://www.heise.de/english/newsticker/news/69684

An E*TRADE Bank executive said that the company had more than $700 million in accounts protected by two-factor authentication and that customers that use a second factor have tripled the money in the accounts compared with a control group that only uses passwords.

Some security and e-commerce companies have touted a future where consumers can sign in once and use that federated authentication throughout the commercial Web.

In the past, Microsoft has tried to turn its Passport online identity system into the backend authentication system for e-commerce providers, but privacy experts worried that the move would give a single company too much power in managing consumer information.

http://www.securityfocus.com/brief/141

New attack vectors will grow precipitously
Look for a big increase in the number of attacks via instant-messaging clients, Internet Protocol telephony, cell phones, Bluetooth and XML.
Rootkits become familiar to the masses
Rootkits become familiar to the masses A rootkit is an extremely clandestine type of malware that hides itself within operating system kernels or application binaries.
Secure development processes become mandatory
Users are simply fed up with sloppy vulnerability-ridden code and weak security support from most independent software vendors. Look for large organisations to clamp down by placing contractual demands on software providers mandating that they implement security processes and metrics or take a hike. Microsoft is ahead of the pack in this area, while “unbreakable” Oracle lags way behind and could lose major contracts as a result.
Security management moves to network operations
At an enterprise level, network security depends on spotting anomalous activities and capturing security events.
Key management becomes a major new requirement
Database, networking, storage and firewall vendors either have or will add encryption to their solutions in 2006.
More security outsourcing It’s hard enough to administer a firewall and intrusion detection systems, to also deal with abundant security solutions for e-mail, IP telephony, Web services, wireless devices, and so on.

“We’re laying the foundation for what we need,” Gates said in a speech at the RSA Conference 2006 here. Even with the advancements, Gates said he wasn’t naive enough to think the password would go away overnight. “I don’t pretend that we are going to move away from passwords overnight, but over three or four years, for corporate systems, this change can and should happen,” he said.

Replacing passwords is part of Microsoft’s endeavor to simplify security, which Gates said is dearly needed. “We have an overly complex system today,” he said. Vista and Microsoft’s upcoming security products, such as Windows OneCare Live and Microsoft Client Protection, will make life easier for consumers, he said.

Microsoft has described InfoCard as a technology that gives users a single place to manage various authentication and payment information, in the same way a wallet holds multiple credit cards. InfoCard is Microsoft’s second try at an authentication technology after its largely failed Passport single sign-on service, unveiled in 1999. InfoCard attempts to address the complaint many critics had with Passport, which was that people’s information was managed by Microsoft instead of by the users themselves and the businesses with which they dealt. Although Microsoft has talked about InfoCard, and early versions of the InfoCard code were released to developers last year, Gates’ speech marked one of the first times Microsoft has demonstrated publicly just how it might work.

In a presentation, Microsoft showed how a consumer could use a self-generated InfoCard to log in to a car rental site and then use a separate InfoCard from a membership group to get a discount on the rental.

Internet Explorer 7 will support InfoCard, Gates announced. The technology will also be available for Windows XP, Microsoft said. InfoCard is one of several technologies Microsoft is developing for Vista, but the company is also making it available for XP.

Microsoft acknowledged that replacing passwords is something that needs to be done at the system level, but Gates said the company is also working on technologies to enable various identity systems used on the Internet to work together, something it calls the Identity Metasystem. In order to provide people with better identity verification as they do business online, Microsoft is asking for a stronger type of digital certificate, a so-called high-assurance certificate. Digital certificates are already widely used today in Web browsers to show that traffic on a Web site is encrypted and that a third party has identified the site and has vouched for its validity. But in recent years, standards of verification have slipped, undermining the sense of security implied by the padlock. That’s why Microsoft and others have called for a new type of certificate.

Microsoft on Tuesday announced the first beta of Microsoft Certificate Lifecycle Manager, a tool meant to streamline provisioning, configuration and management of digital certificates and smart cards, the company said.

Gates also touted several of the other security capabilities that will be part of Windows Vista. In a demonstration, Microsoft showed its anti-spyware technology, as well as a new mode that runs Internet Explorer in its own “sandbox” so Internet code can’t cross over into the rest of a PC.

As expected, the company on Tuesday released a second beta version of Windows AntiSpyware, now called Windows Defender. The first test version of the spyware-fighting tool has been popular, with more than 25 million downloads from Microsoft’s Web site. Windows AntiSpyware has been available in a beta version since January of last year. The program is designed to protect PCs against spyware, which is software installed on a system that’s designed to watch the computer user’s activity without his or her knowledge. Windows Defender already exists by that name in the latest preview release of Vista. Microsoft plans to ship Windows Defender as part of the operating system, it has said. At last year’s RSA Conference, Gates announced that Microsoft would deliver anti-spyware at no cost.

IE 7 also was announced at last year’s RSA event. It includes many security and privacy protection capabilities, such as mechanisms designed to combat phishing attacks, spyware and other threats. Cyberattackers have exploited security flaws and weaknesses in the current version of Microsoft’s Web browser in many attacks. A public preview of IE 7 was released in late January.

http://news.zdnet.com/2100-1009_22-6039177.html