Month: March 2005

Those feeble grades federal agencies have received recently–one report card had an average grade of a D+–means the government will continue to spend heavily on cybersecurity-related IT.

A study by government IT market-intelligence firm Input projects federal IT cybersecurity spending will grow 27% over the next five years. “The effects of 9/11 have changed the way federal agencies approach cybersecurity,” Marcus Fedeli, Input manager of federal opportunity products, said in a statement accompanying the report. “Continued fear over potential terrorist attacks has caused an almost desperate need for improvement of current standards and levels of security. New requirements will cause federal IT security spending to grow steadily this year.”

Among the shortfalls in IT security in federal agencies cited by Input were insecure VPN connections, faulty firewall protection, and the need for customized systems. These vulnerabilities open IT systems to potential fraud, sabotage, and destruction.

Nearly 20%, or the $1.6 billion, of the money that federal agencies are spending this fiscal year on developing, modernizing, and enhancing IT is earmarked for cybersecurity.

“These agencies [will likely] rely heavily on outside contractors to provide the products and services necessary to secure IT systems governmentwide.

http://www.informationweek.com/showArticle.jhtml;jsessionid=ASHSOZUL0AZH0QSNDBNSKH0CJUMEKJVN?articleID=159902278

A number of security providers were overwhelmingly positive about any possible scheme, which will be the focus of a study carried out by an as-yet undecided consultant to the Department of Communications, Information Technology and the Arts.

“We need an Australian national certification scheme for security professionals to take into account our local security issues, legislation and corporate governance needs,” Alan Bell, who is McAfee’s marketing director for the Asia-Pacific region, told ZDNet Australia.

Paul Macrae, who works at MessageLabs in a business development director capacity, said the whole idea was laughable and that there were international standards that could be better applied. “This is ridiculous, it’s just people wasting their time when they could be doing something more serious, like actually protecting or educating the small to medium enterprise (SME) market, which is a much more useful thing,” he said.

And James Turner, who manages the security portfolio at analyst firm Frost & Sullivan, agreed with Macrae. “Australia is not an island on the Internet,” said Turner.

http://www.zdnet.com.au/news/security/0,2000061744,39184626,00.htm

Microsoft described how its forthcoming anti-spyware software classifies potentially harmful software and the actions it will let users take to prevent spyware and other malicious software from damaging PCs.

The Windows AntiSpyware security software, current in beta testing, uses a library of more than 100,000 threats to identify potential problems and make recommendations to users as to whether the questionable software should be ignored, quarantined, or removed.

Microsoft’s security software has been highly anticipated because its Windows operating system and applications have been the main target of viruses, worms, spyware, and other forms of malicious software that infect the Internet and servers and PCs.

“With the exception of malicious behaviors, many of the behaviors [of spyware] could have legitimate purposes,” the paper notes. Their solution look for software that practices deceptive behavior, which could mean problems involving providing notice of what’s running on the user’s machine or problems over control of actions taken by the software. They also look for software that collects, uses, and communicates personal information without explicit consent, that circumvents or disables security software, and that slows or damages a computer’s performance, reduces productivity, or corrupts the operating system.

http://www.informationweek.com/showArticle.jhtml;jsessionid=0FCUBMGWHQ3TSQSNDBNSKH0CJUMEKJVN?articleID=159901026

Inspectors posing as technicians from the agency’s help desk called 100 IRS employees and managers and said that a network problem required them to provide their network log-in usernames. The bogus techs also asked the users to change their passwords to one they suggested. 35% of the IRS workers took the bait.

“With an employee’s user account name and password, a hacker could gain access to that employee’s access privileges,” the report said. “Even more significant, a disgruntled employee could use the same social engineering tactics and obtain another employee’s username and password.”

The same phishing-style scam was run by auditors in 2001, when 71 percent of the workers cooperated and changed their passwords.

http://www.techweb.com/wire/security/159901562