Month: November 2003

Bill Gates Thinks Seamless And Secure

Posted on by admini

The Microsoft chairman outlined for Comdex attendees the software needed to access and share information across a variety of devices, and said security continues to be a pressing issue.

Microsoft demonstrated for the first time a forthcoming tool for bolstering the security of business networks, the Internet Security and Acceleration Server 2004.

On the anti-spam front, Gates said Microsoft’s SmartScreen technology, already being used in the company’s MSN network, Hotmail service, and Outlook E-mail client, will be included “in the months ahead” in Exchange Server 2003.

More info: [url=http://www.informationweek.com/story/showArticle.jhtml?articleID=16100844]http://www.informationweek.com/story/showArticle.jhtml?articleID=16100844[/url]

Read more

Patching is a double-edged sword

Posted on by admini

It also contradicts the way security is usually addressed. While there is much to recommend with regards to automating portions of the patch process, there are also compelling reasons to support manual intervention as a component of the work flow.

Too many have been burned by server farms going dark with a collective “blue screen of death” after applying a buggy service pack and are, quite reasonably, skittish about automatically slapping the latest patches on their production servers. Many release vulnerability warnings concurrently with the patch fixes, escalating the urgency of the patch cycle.
The result is that the industry is between a rock and a hard place on the patch issue.

Case in point: Six months before SQL Slammer hit companies such as Bank of America and Washington Mutual and brought portions of their automatic teller machine networks to their knees, Microsoft had released a vulnerability warning and a patch.

First and foremost, it means taking preventative measures that surround and support the patch management efforts. For patch management, services and tools that fit into the overall system and network management solution–not just that stay siloed in security–work more effectively.

Part of the reason the industry is in reactive mode so much of the time is that security is not seen as critical to the overall business profitability. Part of being proactive is knowing when something doesn’t need to get done and when a patch requires immediate attention. Sometimes reacting after the fact is essential, none of us are soothsayers, and even the most well protected and patched systems may ultimately be attacked.

So be ready with a plan for when that happens; the ability to recover from a critical failure is a part of the overall security posture. The truth is that patching and protecting proactively will reduce vulnerability, but being prepared for the inevitable reactive patching and recovery is essential as well.

More info: [url=http://news.com.com/2010-7355-5107678.html?tag=nefd_gutspro]http://news.com.com/2010-7355-5107678.html?tag=nefd_gutspro[/url]

Read more

Global 1000 Companies Should Hire a Chief Security Officer by the End of 2005

Posted on by admini

The CEO’s primary responsibility is the strategy and direction of the business.
Security should be a concern but CEOs usually have a dozen other things in line ahead of it.

The paramount issue for the CFO is controlling costs. CFOs are not supporters of visions of robust, feature-rich and flexible architectures. Their reason is simple—they cost too much. The CSO must make the CFO understand that centralization of the security vision and spending will ultimately save money. The CSO must also initiate a Net Security Risk (NSR) exercise to calculate the financial risk of avoiding security spending.

The CIO keeps the business systems up and running. CIOs are already battling with the CFO for system budgets. In the wake of that battle, security is squeezed as a “nice to have.” For the CSO to succeed, the CIO must make it clear to the IT professionals that security is a part of all technology and a critical part of their jobs; failing to take this into consideration will lead to immediate termination.

The CTO establishes the technology direction of the company. The CTO, however, should not be in charge of the daily operational responsibilities of the business and should not be tasked with security operations among other technology decisions.

The COO is the battlefield commander responsible for the day-to-day operations of the company. Security adds an additional step to all other business and operational life cycles and thus requires more time, more people and more money, all of which are not central to the COO’s charter. Now there are personal privacy regulations in financial services and health care that make it a legal obligation to secure online information as well.

The CSO is responsible for physical and technology security. The CSO must then communicate this vision across all departments and business units.

More info: [url=http://techupdate.zdnet.com/techupdate/stories/main/global_1000_companies_should_hire_a_chief_security_officer_by_the_end_of_2005.html?tag=tu.fd.sc.link]http://techupdate.zdnet.com/techupdate/stories/main/global_1000_companies_should_hire_a_chief_security_officer_by_the_end_of_2005.html?tag=tu.fd.sc.link[/url]

Read more

Encryption Promises Unbreakable Codes

Posted on by admini

This month, a small startup called MagiQ Technologies Inc. began selling what appears to be the first commercially available system that uses individual photons to transfer the numeric keys that are widely used to encode and read secret documents.

Photons, discrete particles of energy, are so sensitive that if anyone tries to spy on their travel from one point to another, their behavior will change, tipping off the sender and recipient and invalidating the stolen code.

“There are really no ways (of) cracking this code,” said Lov Grover, a quantum computing researcher at Bell Laboratories who is not involved with MagiQ.

Called Navajo – a nod to the American Indian code specialists of World War II – MagiQ’s system consists of 19-inch black boxes that generate and read the signals over a fiber-optic line.

MagiQ (pronounced “magic,” with the “Q” for “quantum”) expects that with a cost of $50,000 to $100,000, Navajo will appeal to banks, insurers, government agencies, pharmaceutical companies and other organizations that transmit sensitive information.

More info: [url=http://www.bayarea.com/mld/mercurynews/business/technology/7277751.htm]http://www.bayarea.com/mld/mercurynews/business/technology/7277751.htm[/url]

Read more

Address proper facilities in your disaster recovery plan

Posted on by admini

To secure the appropriate space, you’ll need to work closely with the people who are responsible for facilities management in your organization. As long as the locations are well outside the line-of-sight horizon, you can shore up these facilities with extra power and air conditioning, allowing them to find new life as backup data centers.

Or look for new facilities that your company has acquired as a result of mergers or takeovers to house the data centers for DR operations. In many cases, you can find floor space already configured to run data operations, since the acquired company most likely has data centers for its operations that won’t be necessary after the merger is complete.

You can also obtain dedicated space in a colocation facility, along with space to house vital employees during an emergency. The downside is that your company may share this reserve space with multiple companies, operating under the idea that only one of the companies will fail over at any give time.

If the first two options aren’t viable, consider working with another company to share data center space so that both organizations have a location for failover.

No matter how you secure space to house your DR failover, it’s a necessary step in your business continuity planning process.

More info: [url=http://techupdate.zdnet.com/techupdate/stories/main/Address_proper_facilities_in_your_disaster_recovery_plan.html?tag=tu.scblog.6673]http://techupdate.zdnet.com/techupdate/stories/main/Address_proper_facilities_in_your_disaster_recovery_plan.html?tag=tu.scblog.6673[/url]

Read more

Wireless hacking bust in Michigan

Posted on by admini

The intruders deployed unspecified hacking software at some of the stores, in once case crashing the point of sale terminals at a Lowe’s in Long Beach, California, according to the affidavit.

At some point, Lowe’s network administrators and security personnel detected and began monitoring the intrusions, and called in the FBI.

Last Friday evening a Bureau surveillance team staked out the Southfield Lowe’s parking lot, and spotted a white Grand Prix with suspicious antennas and two young men sitting inside.

Loveless says he’s noticed that at least some Lowe’s stores don’t take the basic precaution of turning on wi-fi’s standard encryption — called WEP — to declare their network off limits.

More info: [url=http://www.theregister.co.uk/content/69/33959.html]http://www.theregister.co.uk/content/69/33959.html[/url]

Read more