CA Ranked Top Identity and Access Management Software Vendor Again

Posted on by admini

The market is forecast to grow by $4 billion in the next four years, thanks in part to federal mandates included in Sarbanes Oxley and HIPPA, according to the report.

Identity fraud and increasingly high standards for privacy and security are also expected drive growth.

IDC states that Web single sign-on, host SSO, user provisioning, advanced authentification, legacy authorization and directory services are key to identity and access management.

CA’s integrated IAM suite allows customers to centrally operate security systems, reducing complexity and costs.

http://www.techweb.com/wire/security/170101470

Read more

Cisco sensor flaw

Posted on by admini

Cisco said in an advisory that an attacker could use the bug to pretend to be a legitimate Cisco Intrusion Detection Sensor (IDS) or Intrusion Prevention System (IPS), and collect login credentials, submit false data to IDSMC and Secmon or filter what data the two products see.

Cisco also warned, as a separate matter, a bug in its Intrusion Prevention System (IPS) that could allow a local user to gain full administrator privileges.

Although the flaws aren’t highly serious, the fact that Cisco’s products are so widely used gives them more potential impact.

Cisco offered patching instructions for the flaws in its advisories.

http://www.xatrix.org/article4058.html

Read more

Colleges Lead Charge for Secure, Open Networks

Posted on by admini

At Colby-Sawyer College in New London, New Hampshire, almost 1,000 students will arrive on campus this week, most with one or more computers in tow. The influx will more than double the number of systems on the campus network, which operates 50 or 60 Windows and Linux servers and around 650 desktops to support administration and other college employees, said Scott Brown, an information security analyst. All students are provided and required to install free copies of NOD32, a desktop antivirus software product from ESET Software and with Webroot Software Inc.’s Spy Sweeper antispyware software before they connect to the campus network.

To enforce that policy, Brown and his colleagues are using Campus Manager, a product from Bradford Networks Inc. that tracks student computers using their unique MAC (Media Access Control) address. Students who attempt to connect to the campus network are directed by Campus Manager to a virtual LAN where they can install the ESET Software and Webroot Software.

Colby-Sawyer also removes existing antivirus and antispam software from the student computers and connects the system to Microsoft’s Web site to obtain the latest Windows operating system patches, Brown said.

Before giving students access to campus resources, Colby-Sawyer also uses a new CAT (client assessment tool) that scans the student computers and verifies that antivirus and spyware definitions, as well as Windows patches are up to date.

The story is similar at Cornell University, in Ithaca, New York, where network administrators used home-grown technology to quarantine systems belonging to about 6,500 students who arrived on campus last week.

http://www.eweek.com/article2/0,1759,1852852,00.asp?kc=EWRSS03119TX1K0000594

Read more

Banks abandoning SSL on home page log-ins

Posted on by admini
Netcraft noted that three of the largest banks in the U.S. — Bank of America, Wachovia, and Chase — as well as credit card giant American Express, now display their log-in forms on home pages not locked down with Secure Socket Layer (SSL).  The username and password are still encrypted when sent to the bank’s server, however; the form’s Submit or Login button points to an SSL-enabled “https” URL.
 
But as Netcraft noted, Microsoft took the practice to task as long ago as April, when in an entry on the Redmond, Wash.-based developer’s official Internet Explorer blog, program manager Eric Lawrence wrote that the idea was flawed and could be exploited by “man-in-the-middle” attacks.
 
Read more

Gartner’s latest on tablet PCs, social tagging, and other emerging technologies

Posted on by admini

First a good analogy: “In the history of business and consumer use of the Internet, the vast majority of security approaches have relied on customer premises equipment — security hardware and software at the edge of every business or on the PC of every consumer. This is the equivalent of the water company telling you to put water purifiers onto the water pipe into your house because it is sending you many poisonous substances mixed into your water.”

Despite usability and liability obstacles, few would argue that “immunizing” the network for cyber threats this way doesn’t make sense.

Read more

New security breaches disclosure law

Posted on by admini

It also helps protect consumers by giving them the information they need to head off possible identity theft when sensitive details such as Social Security, driver’s license and credit card numbers become exposed.

The Information Security Breach and Notification Act in New York is broadly similar to security breaches laws enacted in California more than two years ago.

Legislation requiring consumer notification of data security breaches has been approved in at least 15 states since then.

New York’s decision to go ahead with its legislation follows a series of high profile consumer data security breaches involving US firms including data mining firm ChoicePoint, payment processing firm CardSystems Solutions and others.

http://www.xatrix.org/article4032.html

Read more