Month: November 2004

Virus names could be standardized

Posted on by admini

The letter, signed by representatives of the DHS, Symantec, Microsoft, McAfee, and Trend Micro, said the industry hopes to address “the challenges surrounding the ‘Virus Name Game’,” with a pilot program coming as early as January.

At first, Common Malware Enumeration (CME) will be confined to “major” threats. Names are often derived from the filenames, the content of the email the worm attaches itself to, or plaintext found inside the code.

http://www.cbronline.com/article_news.asp?guid=11D11704-DE5B-45BD-AF4B-45D8F44E055C

Read more

Companies dig deep for ethics compliance

Posted on by admini

Over the next two years, more than half of U.S. and European multinational companies expect to boost their spending on compliance by 23 percent, according to a new survey of business executives by management consultant PricewaterhouseCoopers.

Nearly all respondents said they plan to make improvements to their company’s compliance efforts, with the average expenditure rising 9.9 percent.

But 44 percent of senior executives said their companies do not have a clear view of its total compliance spending.

Even at companies that do say they have a clear view, executives likely aren’t accounting for other costs, such as those for remediation, penalties, fines, lost revenue and lost management time.

Thirty-two percent of executives described their compliance programs as “very efficient,” while 59 percent rated their programs as “somewhat inefficient.”

The Sarbanes-Oxley Act, passed in 2002, is designed to prevent financial malpractice and accounting scandals. A key provision of the law, Section 404, which took effect Nov. 15, requires publicly traded companies to put in place controls over the flow of financial information.

“Companies are spending significant sums of money–even more than they realize–in order to improve compliance effectiveness and efficiency, but executives are finding that they are not receiving the return on investment they expected,” Dan DiFilippo, head of governance and compliance issues at PricewaterhouseCoopers, said in a statement. “The risks are just too great for companies to operate with ineffective compliance programs.”

External requirements and regulations account for 74 percent of total compliance costs, according to the survey.

U.S. multinationals spend a higher percentage on external requirements than their European counterparts, while European companies spend a higher percentage on compliance with internal guidelines, including ethics rules, codes of conduct and risk management rules. In the United States, compliance with Sarbanes-Oxley regulations accounts for 54 percent of total compliance spending. In Europe, that figure is 12 percent.

http://news.com.com/Companies+dig+deep+for+ethics+compliance/2100-1014_3-5465982.html?part=rss&tag=5465982&subj=news.1014.5

Read more

Security ‘biggest threat’: Microsoft’s Vamos

Posted on by admini

Steve Vamos told attendees at an Australian Information Industry Association event in Adelaide yesterday the security issue was “essentially …

Vamos’ blunt comments come as Microsoft struggles to deal with a raft of flaws uncovered in its flagship Web browser, Internet Explorer (IE), attempts by malicious code writers to disrupt its monthly patching cycle and security researchers’ preparedness to disclose vulnerabilities to all community members at the same time rather than give the vendor some lead time to devise a fix before going public. The Microsoft Australia boss also launched an assault on the software heavyweight’s other bugbear of the moment, competition from Linux and open source solutions.

The use of open source software by government agencies was very much at the forefront of the recent federal election campaign, with all major political parties detailing publicly their policy stance on the issue. The federal government in late August released a guide saying it was preparing a range of tools to help agencies evaluate emerging open source solutions against more familiar proprietary software “on an informed basis”.

“…my view is very straightforward…that whatever alternatives our customers have, be they open source or not, if they are better value for money and better fit for purpose than what Microsoft have, then we’ve got a problem.” Vamos said he viewed the shift to the use of software as a service as “a much bigger movement” than the open source community. The Microsoft boss also said in the corporate arena, rather than just having the chief information officer pushing the IT agenda in the top team, every member of that team had to sign up to it.

http://www.zdnet.com.au/news/security/0,2000061744,39167795,00.htm

Read more

Hidden gold in corporate cleanup

Posted on by admini

Sarbanes-Oxley may strike dread in the hearts of some IT executives, but not Tracy Austin. Austin, the chief information officer with casino operator Mandalay Resort Group, said the financial reporting regulations act resulted in a 30 percent increase in her information technology budget this year and battle-tested her fairly young IT staff. “I was able to beef up our test and development system budget, as well as our firewall and intrusion detection system budget,” Austin said. “Sarbanes-Oxley opened up the awareness of our (chief) executives and prompted questions about…our business risks. So instead of talking about technology, we were talking about what are our business risks and the technology to address them.”

That’s because the regulations laid down in the Sarbanes-Oxley Act and other laws hold executives’ feet to the fire, making them responsible for signing off on the accuracy of their financial statements. Last week, a key section of Sarbanes-Oxley kicked in, turning up the heat. That push to overhaul systems looks likely to be a boon for security technology providers.

Overall spending on complying with the Sarbanes-Oxley Act is expected to reach $5.5 billion this year, according to a recent survey by AMR Research. That’s more than double the $2.5 billion that was spent last year.

And technology companies are expected to grab nearly a third of the multibillion-dollar spending pie in 2005. Companies are spending more on compliance in general, according to a PricewaterhouseCoopers survey released on Tuesday, which found that about half of U.S. and European businesses expect to increase those budgets by an average of 23 percent during the next year to two.

http://news.zdnet.com/Hidden+gold+in+corporate+cleanup/2100-1009_22-5465305.html?part=rss&tag=feed&subj=zdnn

Read more

Hot Technologies For 2005 On the Front Line

Posted on by admini

In this year’s survey (detailed results will appear in VARBusiness’ Jan. 10, 2005, issue and online at www.varbusiness.com), VARs also named Voice over IP, 64-bit processors and radio-frequency identification (RFID) as areas they consider likely to constitute breakthrough technologies for their businesses in 2005.

In thw article, they provided some perspective behind those projections, with technology-based snapshots of these hot segments.

Blade Servers Bust Out Spurred by the advent of new 64-bit microprocessor technologies and the enthusiastic uptake of Linux, VARs don’t find many areas where they move more units than in blade servers. The market is growing at a torrid pace — blade revenues for this year’s second quarter total $233 million, according to IDC, for an annual run-rate of nearly $1 billion. So it’s not unexpected that Tier 1 vendors IBM, Hewlett-Packard and Sun Microsystems are stoking their respective channels with hot products aplenty as they fight a pitched battle for the blade high ground.

With its BladeCenter lineup, IBM is successfully working a dual-processor strategy. Some of the models, like the JS20, sport IBM’s homegrown Power architecture.

For its part, HP is thinking beyond the server box when it comes to its BladeSystem family, pitching it as a total “infrastructure” solution that uses tools such as HP’s Systems Insight Manager software to create a virtualized network.

Resellers would do well to study HP’s tack, since marketing mere blades doesn’t seem nearly as savvy as selling full-fledged utility computing solutions.

And though it is a ways back from IBM and HP, Sun, nevertheless, is going full-speed ahead in blades. Its Sun Fire B100x and B1660 blade platforms give VARs the flexibility of offering customers a mix-and-match assortment of Sparc and x86 processing power, and Solaris and Linux operating systems control.

There’s Something About 64 Bits What’s bigger than a desktop PC but not quite as hefty as those expensive RISC-processor-based boxes that are replacing yesteryear’s mainframes?

Unit sales of commodity servers based on AMD’s high-flying Opteron processors soared 81 percent in the second quarter of 2004, IDC says. Its a hybrid 32-/64-bit CPU, which can run both 32- and 64-bit software via a set of 64-bit instruction-set extensions.

AMD kicked off the category in 2003 with its AMD64 architecture and companion 64-bit instruction-set extensions. These are implemented in AMD’s Opteron server (and companion Athlon 64-bit desktop) processors.

IBM, HP and Sun have all rolled out Opteron servers, as have numerous white-box builders.

Seething on the sidelines as AMD’s technology was rapidly adopted by the market, Intel fired back this summer with its own extensions, called EM64T, and a 64-bit version (formerly code-named Nocona) of its tried-and-true Xeon server CPU. The 64-bit Xeon should stoke additional volume deployments of commodity servers in 2005, IDC says.

Looking ahead, next year will see products push ahead in the form of multicore processors from both Intel and AMD.

Above commodity platforms, at the high end of the market, IBM and Sun are both fielding 64-bit processors. The Power 5, which was publicly unveiled in March, is IBM’s latest iteration of its RISC microprocessor architecture. for Sun, it’s producing a dual-core UltraSparc IV chip, while it paves a path to the 2006 launch of its groundbreaking eight-core Niagara processor.

As for Intel’s high-end play, the Itanium 2, the company has already demonstrated the next-generation version of that processor. Code-named Montecito, it has a multicore design and more than 1.7 billion transistors.

Linux Becomes Likeable No longer the little OS that could, Linux is making a big play to take its place in the center of the enterprise. Although Microsoft has thrust its Windows Server offering into that same space — and is spending $1.7 billion annually in support of its channel partners to make sure it maintains its leadership position — Linux in the enterprise is still moving forward, slowly but surely. Both Red Hat and Novell’s SuSE operation have rolled out enterprise-class versions of their Linux distributions.

Sales of Red Hat Enterprise Linux have reached 144,000 units, including 115,000 subscriptions to enterprise IT servers.

Meanwhile, sales of subscriptions to SuSE Linux Enterprise Server reached 19,000 units in Novell’s recently completed third fiscal quarter.

To help spur deployment, the two vendors are also pursuing reseller programs, albeit with different flavors.

Red Hat, which has rubbed some VARs the wrong way with the perception that it’s out to write as much business for itself as it can, has a list of partners for its Enterprise Linux family, though they skew toward larger OEMs and ISVs, such as BEA, HP, IBM and Veritas.

SuSE had a fairly small partner program when it was acquired by Novell in late 2003. Novell has spent the past year working to fold SuSE into its much larger channel operation.

Boding well for both companies is the fact that vendors such as HP, IBM and Oracle tend to remain Linux-agnostic and support both Red Hat and SuSE according to their customers’ wishes.

Moving ahead on the technology front, watch for Linux to get ever more capable, given the recent addition of support for scalable, high-end servers made possible by the new 2.6 kernel.

Security also will command increased attention, as the kernel enables Linux purveyors to make their distributions compliant with the emerging EAL 4 international standard.

At the same time, security software is expanding to protect against identity theft and proactively assess and stop hacker attacks before they breach the network edge. Computer Associates, for one, has extended its eTrust Security Management software line to encompass such solutions.

VoIP has moved to a new level of reliability that relegates to the past nasty dropouts and other glitches surrounding the digital data packets used to carry voice traffic over the Internet. And, as a $2 billion annual business, it’s finally becoming a field with profit potential.

The most capable of today’s storage systems deliver cutting-edge virtualization capabilities to create separate pools of storage for different application profiles. Logical partitioning and simplified replication features deliver streamlined storage management and optimized application performance.

http://www.securitypipeline.com/news/54200445;jsessionid=BGYJHLBB25A4IQSNDBCCKH0CJUMEKJVN

Read more

Banks look to trial web toolbars to counter phishing e-mail attacks

Posted on by admini

The UK payments association Apacs said banks were investigating the technology as one of a range of countermeasures to tackle the epidemic of phishing.

The disclosure follows an attack on NatWest, which forced the bank last week to suspend the ability to make third-party payments for more than two days affecting one million customers.

Tom Salmond, manager of the e-banking working group at Apacs, said the anti-phishing toolbars had been introduced by sites such as eBay and that the same technology could help bank customers.

Banks are beginning to personalise the e-mails they send to customers by including their names and an agreed code-phrase to help customers to identify genuine e-mails from their bank.

In the longer term, the industry is looking to use two-factor authentication to verify customers’ identities.

Barclaycard is trialling a system that uses low-cost card-readers to generate pass-codes from bank cards.

Interim solutions under investigation include proposals to send SMS messages to customers to confirm transactions, and the introduction of pads of one-time user passwords.

A small number of banks have introduced software to detect suspicious transactions generated by phishing attacks, and this is likely to be taken up more widely, Salmond said.

“This kind of solution will be increasingly adopted in the next six- to nine months,” he said.

Banks are also signing up to services which monitor the internet to detect websites which may be attempting to mimic real banking websites, and provide early warnings of the launch of new phishing attacks.

Apacs plans to launch a publicity campaign to alert the public to the dangers of acting as “money mules” for phishing gangs, over coming weeks.

http://www.computerweekly.com/articles/article.asp?liArticleID=135252&liArti%20cleTypeID=1&liCategoryID=6&liChannelID=22&liFlavourID=1&sSearch=&nPage=1#

Read more