Credit Card Giants Modify Security Specs

Posted on by admini

PCI, which includes specifications for both physical and logical security of credit card data, is required for all merchants who accept credit cards or store credit information. Merchants that don’t comply could face fines as high as $500,000, or, in extreme cases, could have their ability to accept credit cards revoked.

PCI 1.0 was issued two years ago, and merchants were supposed to have achieved compliance by the deadline of June 30 of this year.

Experts say the new guidelines are more clear about “compensating controls,” which give merchants a bit more flexibility in their deployment of encryption and other PCI requirements. David Taylor, vice president of data security strategies at Protegrity and a former industry analyst, isn’t so sure. “The new specs are definitely clearer, and that’s great, but I think a lot of merchants were hoping that the new rules would make it easier to comply, and that didn’t happen,” he says.

PCI auditors previously had hoped that PCI 1.1 would somehow divide the specifications between critical requirements — such as the need for encryption and firewalls — and best practices, such as thorough documentation and training.

http://www.darkreading.com/document.asp?doc_id=103292&WT.svl=news2_1

Read more

Stolen Data’s Black MarketStolen Data’s Black Market

Posted on by admini

“We’ve seen criminals hack into hospital systems just to get the Social Security numbers of the newborns. There’s no one, obvious group of organizations that hackers are targeting.”

There are still plenty of independent hackers out on the Web — just look at the recent Black Hat and Defcon conferences — who might sell vulnerabilities or stolen data by putting them up for auction.

Worms and viruses invented by independent hackers still make up a huge portion of the damage done to corporations each year, Pierson notes.

But the visibility of these individuals and their exploits sometimes belies the growing, but largely unpublicized threat from organized criminals who buy data from hackers or insiders and sometimes contract with them to collect data from a specific corporation, experts agree.

Pierson gives the example of stolen customer credit card data, which is sometimes handled by multiple individuals in a joint effort. While credit card information might be collected through the collaboration of phishers and spammers, that data might then be passed to “cashers” who forge credit cards that use the numbers. Then those cards will be passed out to a network of “mules” who use the cards for small purchases — the kind that might not be immediately detected by the victim — and thrown away. Then the syndicate of players might sell the account information to another buyer, just as the parts of a stolen car might be resold. A similar sort of “syndicate” might be formed to fence stolen business secrets or customer lists to competitors, or to other nations or terrorist groups, he says.

External hackers may be paid off; insiders may be disciplined or dismissed; and in some cases, the crime is never detected. Although there are cases in which external hackers break into an enterprise they find attractive, most targeted attacks involve some help from an insider, experts say.

http://www.darkreading.com/document.asp?doc_id=103198&WT.svl=news2_1

Read more

SAP Pushes Compliance as Strategy

Posted on by admini

Doug Merritt, executive vice president and general manager of suite optimization products and technology at SAP, said that consultants in the compliance arena, regulatory bodies and other vendors will also be able to contribute to this repository. “It allows companies to manage hugely heterogeneous landscapes,” noted Merritt. Merritt said the solution will help risk managers and business owners identify financial, legal and operational risks, analyze business opportunities in light of these risks, and develop appropriate responses.

The key to all three solutions, the company said, is that they give line-of-business executives greater visibility of how governance and risk-management policies are implemented and followed in the course of doing business. Effective GRC management can do more than ensure that companies are in compliance with Sarbanes-Oxley and other regulations, said Merritt. “GRC is more business-driven than just keeping the CEO out of jail,” said Merritt in response to a question from internetnews.com during a conference call this week. “Understanding the relative risks and rewards of different activities is as critical or more critical than regulatory reporting,” he said.

Amit Chatterjee, senior vice president of the risk and compliance management unit at SAP, said that whatever can be monitored can be managed.

SAP GRC Repository and SAP GRC Process Control will be generally available Nov. 30. Other solutions, particularly those pertinent to industry verticals, will become part of the new solution during the second quarter of next year.

SAP also announced that it is bringing these products to market jointly with networking solutions vendor Cisco Systems (Quote, Chart).

http://www.internetnews.com/ent-news/article.php/3630606

Read more

Winning the Compliance Game

Posted on by admini

Auditing woes mostly stem from improperly securing user machines and servers, according to the council’s findings. “The problems being flagged in audits are in user and access controls on PCs and laptops, audit reporting and problems in configuration change management,” Hurley says.

Those with poor audits are spending 43 percent of their IT budget on security equipment and software for IT compliance and those with successful audits, 52 percent. “They are taking money out of labor and putting it into automating the processes” such as measurement and monitoring IT compliance across the board, Hurley says.

“The organizations [surveyed] doing continuous monitoring had the least number of audit deficiencies.”

Meanwhile, security firms that perform vulnerability assessments and penetration testing say regulatory compliance is driving much of their business today. Steve Stasiukonis, vice president and founder of Secure Network Technologies, says regulatory compliance pressures from SOX and HIPAA, for instance, are one of the main reasons his clients hire him.

http://www.darkreading.com/document.asp?doc_id=103041&WT.svl=news2_5

Read more

Cisco, Microsoft Reveal Long-Awaited Network Access Control Plans

Posted on by admini

But the need for network access control won’t wait that long, so businesses will have to continue to control network access using technology already available in some of Cisco’s products and through other security vendors.

By year’s end, Cisco and Microsoft will offer a limited beta program–with no more than three mutual customers–to gain a more realistic understanding of how their access control technologies will work together. As these beta testers will soon find out, combined network access protection and network access control consists of several client-side software applications that check and communicate the health of laptops, desktops, and other devices attempting to connect into a given network.

On the network side, Cisco routers and switches, Cisco Secure Access Control Server, Microsoft Network Policy Server, and policy servers from other vendors work together to give the thumbs up or thumbs down to any device seeking to connect.

Cisco and Microsoft have cross-licensed the Cisco NAC and Microsoft NAP protocols used to communicate information between clients and networks to help ensure their products continue to work together.

A Forrester Research study of 149 technology decision makers at North American companies found that while more than one-third plan to adopt some type of network access control this year, the rest cite cost and manageability as obstacles to deployment.

http://www.informationweek.com/news/showArticle.jhtml?articleID=192501974

Read more

Researchers Challenge DOS Attack Data

Posted on by admini

But because this measurement technique assumes the DOS attack was launched through spoofed IP addresses, it doesn’t account for DOS attacks launched via botnets, which have become a much more attractive vector for attackers, the research team said.

The new study combines traditional indirect measurement of backscatter with direct measurement of Netflow and alarms from a commercial DOS detection system.

http://www.darkreading.com/document.asp?doc_id=103049&WT.svl=news2_3

Read more