July 2004 – CyberSecurity Institute

How to Tackle the Threat from Portable Storage Devices

Posted on July 30, 2004December 30, 2021 by admini

This article shows which strategies and technologies organizations should adopt to manage them securely.

High data capacity and transfer rates, and broad platform support mean that a Universal Serial Bus (USB) or FireWire (IEEE 1394) device has the capacity to quickly download much valuable corporate information, which can be easily leaked to the outside world. This underlying vulnerability has existed since the release of Microsoft Windows 2000, the first widely deployed operating system able to mount a USB storage device automatically.

Intentionally or unintentionally, users can bypass perimeter defenses like firewalls and antivirus at mailserver, and introduce malware such as Trojan Horses or viruses that, if not discovered, can cause serious damage.

This means there is more risk of legal action if personal information – belonging to corporate clients or employees – ends up in the hands of an unauthorized third party. Companies are at risk of losing intellectual property and other critical corporate data. Portable storage devices are also ideal for anyone intending to steal sensitive and valuable data.

What are company requirements and strategies for deploying these devices in the workplace?
Companies should forbid the use of uncontrolled, privately owned devices with corporate PCs. The prohibition should extend to employees, and external contractors with direct access to corporate networks.

What are the best practices in managing these devices?
– Adopt a suitable security policy on using portable storage devices
– Use tools to help manage port access of USBs and FireWire
– Consider using digital rights management technology as part of a wider protection strategy for proprietary information

http://www.csoonline.com/analyst/report2714.html

Details of Microsoft antivirus software leak out

Posted on July 28, 2004December 30, 2021 by admini

A standalone antivirus product will be built from tools the company inherited through its 2003 acquisitions of GeCad and Pelican Software, according to a report published in CNET News.com’s sister publication, ZDNet France, citing the technical head of Microsoft’s security project in that country, Nicolas Mirail. Microsoft representatives in the United States refused to comment on functional elements or a potential production time frame for the antivirus package.

However, Mirail said the Microsoft antivirus software will utilize two different means of detecting destructive files, the first of which will reference a regularly updated list of known viruses to check for potential infections. The second antivirus tool will analyze computer systems to assess whether they have been hit by a virus in the past and attempt to give end users an idea of how at risk their computers might be for future problems.

The executive indicated that the antivirus package will not come with firewall security software but said a firewall would be built into the company’s Windows XP operating system when Microsoft delivers its Service Pack 2 update. Mirail said the product would work with both Windows XP and the Longhorn release of Windows.

Microsoft has been rumored to be seeking a high-profile acquisition in that arena, and security specialist Network Associates was said to be on the company’s radar.

Earlier this month, another European security executive at Microsoft said the company’s antivirus plans remain in their early stages, including the integration of the products it has amassed via acquisition. When Microsoft purchased GeCad, which is based in Bucharest, Romania, it positioned the acquisition as the next step in its Trustworthy Computing initiative, a move aimed at securing what Microsoft estimates are the nearly two-thirds of Windows users who don’t have up-to-date antivirus software on their computers. The company said at that time that it might launch a paid-subscription service for Windows users.

http://news.com.com/Details+of+Microsoft+antivirus+software+leak+out/2100-7349_3-5287496.html?tag=nefd.top

Security Beats Holding Down Costs In IT Concerns

Posted on July 26, 2004December 30, 2021 by admini

A survey earlier this year of 933 U.S. and Canadian companies found that more than three quarters of the respondents rated security as an “extremely or very significant” concern or IT challenge for their organizations, International Data Corp. said.

“Our latest survey findings indicate that IT spending on security and business continuity has increased at 59 percent of organizations in the last 12 months,” IDC analyst Lucie Draper said in a statement. We believe that despite the economic environment, and in some cases because of the geopolitical environment, the prospects for vendors of security technologies are good.”

Other findings included that corporate compliance and government regulations related to security and privacy remained of particular concern to the banking and the healthcare services industries.

http://www.techweb.com/wire/story/TWB20040726S0010

2004: A dreadful half-year for malware

Posted on July 26, 2004December 30, 2021 by admini

So far this year, 31 viruses have been classed as a medium risk or higher, compared to 20 in the whole of 2003.

The main factor behind this rise is the battle between the authors of the Bagle and Netsky viruses, who each launched a volley of malicious code containing insults about their rivals.

Today, there are still three variants of both Bagle and Netsky that McAfee classes as a medium threat.

An average of 50 new pieces of malware have been released on the Internet each day this year, according to the company, and McAfee is forecasting that by the end of 2004 another 18,000 new pieces of malware will have been created.

“The rise in viruses, worms, Trojans and unwanted programs such as spyware, hacking tools and password stealers in the first half of 2004 has already surpassed what we saw throughout all of 2003, bringing us very close to the 100-thousandth mark for identified threats,” said Vincent Gullotto, vice president of McAfee AVERT, the company’s antivirus emergency response team.

The forecast for the rest of 2004 and beyond is not heartening. McAfee expects that spyware and adware will become more of a problem, especially spam emails that deposit spyware on a user’s PC after they are opened.

Phishing attacks, in which organised criminals attempt to fool people into disclosing their banking details by creating a fake Web site are also predicted to rise – as many users are still blind to the danger of clicking on attachments from unknown sources, according to McAfee.

http://news.zdnet.co.uk/0,39020330,39161677,00.htm

Six software firewalls reviewed and rated

Posted on July 24, 2004December 30, 2021 by admini

In this report, they asked six top vendors to provide products that deliver firewall protection to the enterprise network.

The hardware alternatives offer one distinct advantage as these appliances come complete with processor, memory and embedded operating system which provides intrusion detection and prevention straight from the box.

A key feature in four of the products was the inclusion of workstations that allowed policies to be managed from the desktop. Virtually all hardware firewalls use stateful inspection which intercepts packets at the network layer, then analyses the header and contents of each packet to determine its communication state, as well as the source and destination addresses. Although basic packet filtering offers higher performance, security is reduced as most filtering mechanisms only examine packets at the network layer and are unable to determine what application they are bound for. Only the Zone Labs’ firewall product implements stateful packet inspection – a feature drawn from its popular personal firewall software.

To test installation, configuration, deployment and reporting of the central management consoles of each product we used a Pentium III 733-equipped system with 256Mb of memory and running Windows 2000 Server, while client duties were handed out to a variety of workstations running Windows 98 SE, ME and 2000 Professional.

Review: http://www.whatpc.co.uk/products/software/1133254

Cisco Fortifies WLAN Security

Posted on July 19, 2004December 30, 2021 by admini

While Cisco is not the first wireless LAN provider to embrace Advanced Encryption Standard, its support will bring peace of mind to many IT managers who have standardized on the leading enterprise WLAN provider’s technology—especially those required to offer government-caliber security for their wireless networks.

By year’s end, Cisco will introduce “Kodiak,” an 802.11a radio module for the popular Aironet AP1200 access point, according to sources familiar with the San Jose, Calif., company’s plans. Kodiak supports the IEEE 802.11i security protocol, ratified last month, which is based largely on AES. There will be two versions of the module, one with an integrated antenna and one with connectors for remote antennas, the sources said.

Cisco also will introduce software that supports AES for Kodiak and for its 802.11g AP1100 and AP1200 access points. AES is a federally approved encryption standard based on 128-bit keys generated by the Rijndael algorithm, resulting in stronger encryption than either TKIP (Temporal Key Integrity Protocol) or the more common WEP (Wired Equivalent Privacy). AES can be difficult to implement on an existing WLAN, especially for campuses with hundreds of access points.