Skip to content

CyberSecurity Institute

Security News Curated from across the world

Menu
Menu

Month: March 2005

Enterprise security boom continues

Posted on March 31, 2005December 30, 2021 by admini

Last year the market grew 49 per cent year-on-year to €536m, with Cisco dominating with 21 per cent of the market.

Nokia is the fastest growing vendor, however, with sales increasing by over 90 per cent on the quarter.

“The security market is poised to extend its impressive track record into 2005 and beyond,” said Andy Buss, senior analyst at Canalys. “Our expectation is that 2005 will be up by more than 15 per cent over 2004. Vendors need to continue the pace of innovation and integration, partnering where necessary to ensure short time to market and to develop industry-wide interoperability.”

The biggest growth area has been in security hardware, with 65 per cent year-on-year increases. This is part of a wider move to build security into the network at a hardware level.

The reseller channel has also proved important. Juniper saw its sales grow 57 per cent after an intensive channel support programme, and the Canalys research found that the channel as a whole benefited towards the end of the year as companies started spending the last of their annual budgets.

The findings contradict statements made by Gartner last month that this year would see the start of a decline in security spending.

http://www.computing.co.uk/news/1162250

Read more

Having a problem with IT? Blame the sales rep

Posted on March 31, 2005December 30, 2021 by admini

The report — called IT Priorities — is culled from a survey of 1,400 IT decision makers from what are described as mid-sized companies in Canada, the United States and Britain.

It’s a worrying figure but, in my view at least, part of the blame is being laid at the wrong door. First, before anybody runs away with the idea that the failure of IT projects is rampant, it’s necessary to look further into the study’s findings.

In a later section of the report, Info-Tech admits the majority of IT projects are in fact delivered on time, on budget and do meet expectations. Well, some projects inevitably fail to measure up, and getting good results most of the time isn’t good enough, it seems.

Failure is failure, and the infrequent missteps are tarnishing the reputation of IT groups in the eyes of business executives, the researchers say. “Only 5 per cent of enterprises told us they were always on time,” the report states. This indicates that 95 per cent of IT shops are not delivering some number of projects on time or to the full satisfaction of the business executive. This is a major contributor to a misalignment of business and IT.” The latter statement seems a bit harsh, since IT by its very nature is imperfect.

Consider the breakable operating systems in widespread use at most companies, coupled with desktop hardware that often delivers less-than-predictable performance. As a result, it’s arguable that most businesses are accustomed to experiencing something less than perfection when it comes to technology and, by extension, IT projects (including the “successful” ones).

But let’s take the researchers’ claim at face value.

Info-Tech asserts that the top three “perceived” reasons for project failures include unrealistic time frames, staff shortages and poorly defined project scopes — results that would make most IT consultants positively giddy, given that two of the three are practically open invitations for their services. These may be contributing factors, but in my experience the bottom line is simply that failures sometimes occur and people, even highly skilled IT workers, occasionally make mistakes. IT departments can’t always anticipate what will go wrong and they don’t usually know when they’re embarking on a doomed project. But when laying blame for problems, here’s something the researchers may not have considered.

Vendors, rather than IT staff, might be the ones ultimately at fault in some of the most serious project failures. That assertion comes as a result of some rather passionate comments made during an informal session of IT World Canada’s most recent chief information officer exchange, a regular meeting of top IT executives from government, finance and manufacturing. A pet peeve expressed at the meeting was that many IT companies overstate their products’ capabilities.

In some instances, it was reckoned that an overzealous salesperson sold a bill of goods that fell well short of what a CIO may have thought was being purchased. This becomes a particularly nasty problem when the shortcomings of the solution don’t become apparent until the project is well under way. Those shortcomings can be the primary reason behind a failed (or at least late) project.

And instead of the vendor, it’s the IT staff doing the integration work that tends to take the heat from management.

Let’s be clear about the magnitude of this sort of problem. I heard this complaint again and again from seasoned CIOs, people who have lots of technical knowledge and experience dealing with vendors. Distressing, too, is the fact that senior executives of these technology suppliers may not be entirely aware of this customer dismay, or of the less-than-forthright sales practices of some of their own reps. False claims by individual salespeople suggest a short-sighted approach aimed at getting the deal done, hitting the sales target and moving on to the next prospect. It’s a situation that frustrates the customer, who wonders why the supplier doesn’t take the time to understand his business and send knowledgeable salespeople who can propose solutions that might actually be useful.

http://www.globetechnology.com/servlet/story/RTGAM.20050331.wmclean31/BNStory/Technology/

Read more

Windows 2003 Server SP1 a big plus for wireless LAN security

Posted on March 31, 2005December 30, 2021 by admini

With the recent leaps in cryptanalysis tools that can even crack enterprise grade wireless LANs that use dynamically rotating WEP keys, the encryption bar has been raised to a minimum of TKIP or preferably AES. In order to run these newer encryption algorithms, hardware and software must be certified to a minimum of WPA or the newest WPA2 standard. Unfortunately, performing the upgrade is easier said than done especially if firmwares, drivers, and configuration changes have to be replicated across hundreds or even thousands of clients. While it doesn’t address all of these issues, Windows 2003 Service Pack 1 at least makes the last piece (configuration changes) relatively simple and is a huge step forward for any business grade wireless LAN.

While the original version of Windows 2003 Server already made substantial strides in easing the pain of a large secure wireless LAN deployment, its major weakness was that it couldn’t deal with WPA capable networks. SP1 addresses these weaknesses and really makes it easy to deploy a large secure a wireless LAN. The following summarizes the original feature set of Windows 2003 server and the enhancements of SP1.

Windows 2003 added PEAP authentication capability to its IAS (Internet Authentication Service) RADIUS component. This meant that client side certificates were no longer needed for TLS encrypted authentication which makes it possible to only use a server side Digital Certificate to support thousands of clients who don’t have Digital Certificates. By using the TLS tunnel to secure the password exchange, dictionary attacks on the popular LEAP authentication protocol could be avoided altogether.

The built-in Windows XP WZC (Wireless Zero Configuration) client could now be centrally managed via Windows 2003 Server using Active Directory Group Policy configuration. This meant that every single client computer on a corporate network could be centrally configured to connect to a secure wireless LAN in minutes. Since WPA was only starting to appear at the time Windows 2003 was being released, the policy configuration could only work for 802.1x/PEAP dynamic WEP based wireless LANs. WPA using TKIP or AES encryption was not supported and had to be manually configured from the client side which made it very difficult to deploy.

Fast reconnect for EAP authentication support was added to IAS. Note that this can cause problems with some Access Point manufacturers that don’t deal well with fast reconnect.

Active Directory Group Policy can now configure WPA TKIP or AES encryption settings. Any Windows XP SP1 (with WPA patch) or Windows XP SP2 client machine could now be centrally configured to connect to a TKIP or AES encrypted wireless LAN.

Clients (Windows XP SP2 only) can now also be locked down to a narrow set of administrator approved Digital Certificates and Certificate Signing Authorities. In the past, there was a potential for unsuspecting users to fall victim to man-in-the-middle attacks if an attacker could coax a user into trusting a rogue Access Point which used a fake RADIUS Authentication Server with an alternate Digital Certificate and Signing Authority. The importance of central management cannot be overstressed. This isn’t just a convenience issue but a security issue as well.

http://blogs.zdnet.com/Ou/index.php?p=47

Read more

The U.N. thinks about tomorrow’s cyberspace

Posted on March 31, 2005December 30, 2021 by admini

That remains the province of specialized organizations such as the Internet Corporation for Assigned Names and Numbers, or ICANN; the Internet Engineering Task Force; the World Wide Web Consortium; and regional address registries. Though Zhao is far too diplomatic to state it directly, the ITU’s increasing interest in the Internet could presage a power struggle between ITU, ICANN, and perhaps even the U.S. government, which retains some oversight authority over ICANN and appears content with the current structure.

“The whole world is looking for a better solution for Internet governance, unwilling to maintain the current situation,” Houlin Zhao, director of the ITU’s Telecommunication Standardization Bureau, said last year. Zhao, a former government official in China’s Ministry of Posts and Telecommunications, has been in his current job since 1999. “Countering spam is just one of many elements of protecting the Internet that include availability during emergencies and supporting public safety and law enforcement officials,” Zhao wrote in December.

Also, he wrote, the ITU “would take care of other work, such as work on Internet exchange points, Internet interconnection charging regimes, and methods to provide authenticated directories that meet national privacy regimes.”

This article documents an interview with Houlin Zhao, director of the ITU’s Telecommunication Standardization Bureau.

http://news.zdnet.com/2100-9588_22-5648953.html

Read more

Study indicates Canadians fear identity theft over virus attacks

Posted on March 30, 2005December 30, 2021 by admini

However, 64 per cent of Canadians surveyed were unable to accurately define the term “phishing” – the increasingly common practice of using fraudulent spam emails and fake corporate Websites to fool recipients into divulging personal financial data.

Phishing email messages mimic a legitimate source such as a bank or an online auction site. Messages notify recipients that an update is required to their account information and directs them to follow a link where they are asked to provide personal account information.

In rating security, men and women differed slightly in their online priorities in the Aol study. Forty-two per cent of women versus 36 per cent of men rated identity theft as their number one concern. However, more men (22 per cent) than women (10 per cent) rated spyware or adware tracking their online habits as their primary online security concern.

While Canadians list identity theft (39 per cent), viruses (31 per cent) and spyware (16 per cent) as major security concerns, they are less fearful of spam in general.

Only nine per cent of respondents listed spam among their primary security concerns.

http://www.canada.com/technology/story.html?id=917533a9-8e14-4410-9e5b-3f5c71977cfd

Read more

Phishing attacks ease off

Posted on March 30, 2005December 30, 2021 by admini

Research from the Anti-Phishing Working Group (APWG) found 13,141 new phishing emails were reported to the organisation in February, an increase of just two percent compared to results from January.

The number of phishing Web sites supporting these attacks only rose by 1.8 percent — from 2,578 to 2,625 — over the same period.

Phishing scams attempt to lure victims into parting with confidential information. Scammers typically send an email, purporting to be from a bank or e-commerce vendor, that links to Web sites that mimic those companies, but are actually hosted by scammers.

The group claims that the monthly growth rate of phishing attacks since July 2004 is 26 percent.

However since the APWG results depend on the number of people that report phishing scams to its Web site the increase in reported scams could simply have been due to growing awareness of the APWG and its actions.

It’s not clear why there was such a small rise in reported phishing scams between January and February 2005.

The report also confirmed that scammers have started using a new practice called pharming — a technique that hijacks domain names and secretly redirects users to fraudulent Web sites.

http://news.zdnet.co.uk/internet/security/0,39020375,39193153,00.htm

Read more

Posts navigation

  • 1
  • 2
  • 3
  • 4
  • …
  • 13
  • Next

Recent Posts

  • AI/ML News – 2024-04-14
  • Incident Response and Security Operations -2024-04-14
  • CSO News – 2024-04-15
  • IT Security News – 2023-09-25
  • IT Security News – 2023-09-20

Archives

  • April 2024
  • September 2023
  • August 2023
  • July 2023
  • June 2023
  • April 2023
  • March 2023
  • February 2022
  • January 2022
  • December 2021
  • September 2020
  • October 2019
  • August 2019
  • July 2019
  • December 2018
  • April 2018
  • December 2016
  • September 2016
  • August 2016
  • July 2016
  • April 2015
  • March 2015
  • August 2014
  • March 2014
  • August 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • October 2012
  • September 2012
  • August 2012
  • February 2012
  • October 2011
  • August 2011
  • June 2011
  • May 2011
  • April 2011
  • February 2011
  • January 2011
  • December 2010
  • November 2010
  • October 2010
  • August 2010
  • July 2010
  • June 2010
  • May 2010
  • April 2010
  • March 2010
  • February 2010
  • January 2010
  • December 2009
  • November 2009
  • October 2009
  • September 2009
  • June 2009
  • May 2009
  • March 2009
  • February 2009
  • January 2009
  • December 2008
  • November 2008
  • October 2008
  • September 2008
  • August 2008
  • July 2008
  • June 2008
  • May 2008
  • April 2008
  • March 2008
  • February 2008
  • January 2008
  • December 2007
  • November 2007
  • October 2007
  • September 2007
  • August 2007
  • July 2007
  • June 2007
  • May 2007
  • April 2007
  • March 2007
  • February 2007
  • January 2007
  • December 2006
  • November 2006
  • October 2006
  • September 2006
  • August 2006
  • July 2006
  • June 2006
  • May 2006
  • April 2006
  • March 2006
  • February 2006
  • January 2006
  • December 2005
  • November 2005
  • October 2005
  • September 2005
  • August 2005
  • July 2005
  • June 2005
  • May 2005
  • April 2005
  • March 2005
  • February 2005
  • January 2005
  • December 2004
  • November 2004
  • October 2004
  • September 2004
  • August 2004
  • July 2004
  • June 2004
  • May 2004
  • April 2004
  • March 2004
  • February 2004
  • January 2004
  • December 2003
  • November 2003
  • October 2003
  • September 2003

Categories

  • AI-ML
  • Augment / Virtual Reality
  • Blogging
  • Cloud
  • DR/Crisis Response/Crisis Management
  • Editorial
  • Financial
  • Make You Smile
  • Malware
  • Mobility
  • Motor Industry
  • News
  • OTT Video
  • Pending Review
  • Personal
  • Product
  • Regulations
  • Secure
  • Security Industry News
  • Security Operations
  • Statistics
  • Threat Intel
  • Trends
  • Uncategorized
  • Warnings
  • WebSite News
  • Zero Trust

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org
© 2025 CyberSecurity Institute | Powered by Superbs Personal Blog theme