Microsoft muscles into security market with Client Protection

Posted on by admini

“This approach enables businesses to spend less time dealing with malicious software threats and more time managing other IT needs that help improve the bottom line,” said Microsoft.

Microsoft Client Protection will also integrate with Active Directory and software distribution systems to reduce the time it takes to deploy security updates and patches.

Microsoft also plans to release Microsoft Antigen anti-virus and anti-spam security software for messaging and collaboration servers, based on technology from recently acquired Sybari Software. Antigen for Exchange is scheduled to be available in beta in the first half of 2006.

In spite of its intention to offer “a single solution” for desktop security, Jay Heiser, research vice-president at analyst firm Gartner, said Microsoft was unlikely to produce a strong security suite.

http://81.144.183.106/Articles/2005/10/19/212523/MicrosoftmusclesintosecuritysoftwarewithClientProtection.htm

Read more

Tighten Web Security, Banks Told

Posted on by admini

In two-factor authentication, customers must confirm their identities not only through something they know, like a PIN or password, but also with something they physically have, like a hardware token with numeric access codes that change every minute. Other types of two-factor authentication include costlier hardware involving biometrics or “smart” cards that would be inserted into designated readers on a user’s computer.

Banks might also issue one-time passwords on scratch-off cards or require “secret questions” about a customer’s account, such as the amount of the last deposit or mortgage payment.

The council also suggested that banks explore technology that can estimate a web user’s physical location and compare it to the address on file.

The most common way of stealing consumers’ personal identity data and financial account credentials online, known as phishing, typically involves sending e-mails that direct unwitting users to phony websites. Data harvested at such sites is then used fraudulently. The Anti-Phishing Working group, an industry association, reported 13,776 unique types of phishing attacks in August.

While some financial institutions have given their customers electronic password tokens, those have tended to be optional. Other banks have instituted password entry through mouse clicks instead of typing, a protection against keystroke-snooping programs.

FDIC spokesman David Barr said the rules will serve as standards that will be checked when banks’ practices are audited. Although the requirements apply just to financial services companies, the policy could stimulate wider use of two-factor authentication by other merchants that are willing to “federate” their websites with banks, said Michael Aisenberg, director of government relations for internet service provider VeriSign.

http://www.wired.com/news/business/0,1367,69243,00.html

Read more

NEW USA FFIES Guidance

Posted on by admini

Highlights:
– Financial institutions offering Internet-based products and services should use effective methods to authenticate the identity of customers using those products and services.
– Single-factor authentication methodologies may not provide sufficient protection for Internet-based financial services.
– The FFIEC agencies consider single-factor authentication, when used as the only control mechanism, to be inadequate for high-risk transactions involving access to customer information or the movement of funds to other parties.
– Risk assessments should provide the basis for determining an effective authentication strategy according to the risks associated with the various products and services available to on-line customers.
– Customer awareness and education should continue to be emphasized because they are effective deterrents to the on-line theft of assets and sensitive information.
http://www.fdic.gov/news/news/financial/2005/fil10305.html

Read more

PGP Encrypts BlackBerry Messaging

Posted on by admini

The solution runs in conjunction with PGP Universal, a series of products for enterprises, businesses and departments requiring multiple encryption and digital-signature solutions managed from a single console. With PGP Universal, enterprises deploy one key infrastructure and may later add new encryption capabilities and devices without changing that infrastructure.

PGP support is fully integrated in the BlackBerry user interface (see top image) and provides e-mail encryption, decryption, digital signature, and verification services for e-mail sent from and received on BlackBerry devices. Users authenticate themselves with their private key passphrase before decrypting or signing e-mail on their BlackBerry. Outgoing messages are automatically protected according to a centralized policy specified by the PGP Universal administrator. PGP Universal uses PGP Additional Decryption Key (ADK) capabilities, automated key management and recovery, and automated enrollment and centralized policy management.

PGP VP of marketing Andrew Krcik told SmartPhoneToday PGP Support Package for BlackBerry will be available as part of the BlackBerry handheld 4.1 operating system next month.

It also requires BlackBerry Enterprise Server for Exchange 4.0.2 or Lotus Notes 4.1 and PGP Universal Series 500 plus PGP Desktop 9.0 or PGP Universal Satelite client to run.

Furthermore, Krcik said PGP brought the idea for the solution to RIM because they shared so many customers and it filled a need requested by many enterprises. “BlackBerry is the overwhelming leader for enterprise mobile messaging. By providing an integrated PGP Universal and BlackBerry solution, we address a strategic requirement of our joint customers,” according to PGP CEO & President Phillip Dunkelberger.

PGP Support Package for BlackBerry costs $249 per client, with volume discounts available for channel partners.

http://www.rimroad.com/articles/2005/10/2005-10-10-PGP-Encrypts-BlackBerry.html

Read more

Top Ten Strategic Priorities for 2006 according to PWC, CSO and CIO

Posted on by admini

– Disaster recovery/business continuity
– Employee awareness programs
– Data backup
– Overall information security strategy
– Network firewalls
– Centralized security information management system
– Periodic security audits
– Monitoring employees
– Monitoring security reports (log files, vulnerability reports and so on)
– Spending on intellectual property protection

This list further reinforces the reactive nature of information security. Awareness programs often score high as a strategic priority because they’re relatively low-cost. One should expect number 10 on this list will shoot up in priority next year, given the steady stream of identity thefts and other major information crimes.

http://www.csoonline.com/read/100105/survey_topten.html

Read more

How ‘Good’ is Your Security Policy?

Posted on by admini

It is not unusual for organisations to have a number of disparate documents distributed throughout the business, each addressing various issues such as acceptable use of company e-mail and the Internet, physical security of company assets, and so on.

Security policies have a number of human, financial and legal consequences. Because of this, great care needs to be taken to ensure that such policies accurately reflect the current situation.

Certainly, the legal requirements for the protection of personally sensitive data have changed dramatically of late and it is common to discover that individual organisations’ security policies have not kept pace. Additional legislation dealing with the protection of data and monitoring in the workplace has been introduced recently that may have a significant impact on both public and private sector organisations. Many organisations are required to demonstrate to external and internal auditors that they meet prescribed standards in the way in which they secure and operate their businesses Correctly interpreting how the various pieces of legislation and corporate governance guidelines apply to your organisation is a serious challenge and one where mistakes potentially can prove very costly.

Best practise (BS-7799/ISO-17799) recommends that security polices are updated regularly so as to ensure organisations continue to protect themselves from the risk of security breaches whilst remaining legally compliant.
· Does your current policy incorporate sufficient procedures to cover the use of Personal Digital Assistants (PDAs) and similar mobile devices?
· Do any of your personnel work remotely or on the move and, if so, are they connecting securely?
· Are you aware of the main areas contained within ‘The Telecommunications Lawful Business Practise Regulations’ and ‘The Employment Practices Data Protection Code’ in respect of the monitoring of communications?
• Does the Civil Contingencies Bill (which came into force last year) apply to your organisation?

If you are unsure about any of these issues – and this is by no means an exhaustive list – it is highly likely that your security policy needs reviewing and updating.

http://www.ebcvg.com/articles.php?id=935

Read more