Month: May 2005

Homeland Security Signs Up For Symantec’s Threat Network Data

Posted on by admini

Homeland’s Information Analysis and Infrastructure Protection Directorate (IAIP) inked the deal with Symantec to add the Cupertino, Calif.-based company’s data — acquired in large part from its global network of some 20,000 sensors deployed in 180 countries — to the information already collected and analyzed by the federal agency, which is tasked with the chore of improving computer security preparedness and responding to cyber attacks in the U. S.

“We’re building out our cyber-situational awareness,” said Andy Purdy, the acting director of the National Cyber Security Division of Homeland Security. “We believe that the [Symantec] DeepSight alerts and services will help enrich the information sources to the federal government and its stakeholders.”

Data from both Symantec’s DeepSight Alert Services and DeepSight Threat Management System will be integrated within the US-CERT Portal, a secure site accessible only to federal information security officers.

The off-the-shelf DeepSight data — it’s not being tweaked for the feds, said Symantec executives — provides early warning of developing cyber-threats and analysis of both in-the-wild exploits and vulnerabilities in more than 18,000 different pieces of software.

“The time that organization have to respond to a threat is constantly shrinking,” said Oliver Friedrichs, the senior manager of Symantec’s security response team. The window Friedrichs referred to is the time between the disclosure of a vulnerability and the appearance of the first exploit leveraging that vulnerability. “Right now that window averages just a bit more than six days,” he added. Friedrichs touted Symantec’s DeepSight data as something difficult for a government agency like US-CERT to reproduce on its own.

“Although DeepSight is just one of a number of data contributors to US-CERT, its sensor network isn’t that easy for just anyone to build. The data from DeepSight will also be used, said Purdy, by US-CERT’s analysts to broadcast alerts to businesses and the public about specific cyber-threats. In the end, however, Symantec’s addition to the CERT data stream is just another feed. By combing as much data as possible, said Purdy, CERT has a better chance of being on the mark.

One of US-CERT’s missions is to publicize outbreaks via its own e-mail based alerts.

http://www.techweb.com/wire/security/162600188

Read more

Where’s the cybersecurity coverage these days?

Posted on by admini

“As specialist insurance becomes more affordable, I expect the take up to increase,” said Oliver Brew, a technology underwriter for London-based Hiscox Plc.

Because of vaguely worded state and federal regulations and the impossibility of 100% network security, a new type of insurance claim is emerging — one that protects insured enterprises against privacy-related lawsuits under provisions of the Graham-Leach-Bliley Act, California State Bill 1386 and other regulations.

“We are seeing breach of privacy claims due to unauthorized access to or use of personal identifiable information,” said Peter Foster, senior vice president and co-leader of the information risk management practice at Marsh Inc., a leading risk and insurance services firm. “Regulatory requirements to publish the breach incident are triggering multi-party lawsuits that have cost insurers excess of $1 million per incident in some cases.”

Cyberinsurance covers a number of other areas often not available in traditional business policies, including denial-of-service attacks, damage cased by hackers, malicious insiders, worms and viruses, and electronic theft of confidential information.

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1084419,00.html

Read more

Internet Telephony and Security

Posted on by admini

It opens up the floodgates for hackers to infiltrate phone conversations and steal confidential data. And spammers can target the system with massive denial-of-service (DoS) attacks.

· Two-thirds of the Global 2000 are expected to implement VoIP by 2006, according to Deloitte Services LP (eWEEK, December 4, 2004).

· In a survey of 500 IT professionals released earlier this year, the Computing Technology Industry Association found that 73 percent of the respondents said they use or plan to use convergence hardware and software over the next 12 months (“Voice-over-IP Offers Greatest Productivity Gains,” February 9, 2005).

· Gartner Inc. expects the market for VoIP services to continue to expand at double-digit rates in 2005 (“North American Business VoIP Services Emerging,” March, 2004).

As the recently formed VoIP Security Alliance has observed, advances in information technology typically outpace the corresponding security requirements, which are often tackled only after these technologies are widely deployed. Such is the case with VoIP today.

Now that VoIP deployments are becoming more widespread, the technology is proving a more attractive target for hackers, increasing the potential for harm from cyberattacks. Moreover, the emergence of VoIP application-level attacks will likely occur as attackers become more familiar with the technology through exposure and easy access. And the consequences of an attack can be staggering. Successful attacks against a combined voice and data network can cripple an enterprise, halt communications required for productivity, and result in irate customers, lost revenue, and brand impairment.

That’s why the VoIP Security Alliance plans to disseminate knowledge of VoIP security risks through discussion lists, white papers, and research projects. The group hopes to spur adoption of VoIP by promoting best practices for companies that adopt the technology, and by warning organizations of threats to VoIP, including spam and DOS attacks.

With enterprise interest in VoIP heating up, Gartner has found that CIOs and network managers are acutely concerned about securing VoIP, so that it provides the same level of security as traditional time division multiplexing (TDM) devices and the public switched telephone network (PSTN). In a recent report (“Voice Over IP Communications Must Be Secured,” November, 2004), Gartner predicts that IP communications will continue to be less secure than TDM communications through 2006; that DoS attacks will regularly be used to disrupt VoIP communications by 2008; and that the next year will see convergence-specific viruses/worms begin to attack VoIP-specific equipment.

Issues include surrounding guaranteed bandwidth, delay, jitter, packet loss, and the timely delivery of signaling messages. It would be easy to use a combination of traditional IP security techniques, payload and signaling encryption. The holdup is that each company must justify the costs of a convergence project and judge whether the potential productivity enhancements and cost savings outweigh the costs of ripping out working telecom gear.

http://www.ebcvg.com/articles.php?id=697

Read more

BorderWare Releases Version 5.0 Of MXtreme E-Mail Firewall

Posted on by admini

MXtreme 5.0 is specifically designed with increased performance to better protect an organization’s e-mail infrastructure against attacks that can bring down a corporate e-mail system in real time.

E-mail is business critical and time sensitive, so any delays in processing due to volume spikes or increasing volumes are unacceptable,” said Tim Leisman, CEO, “MXtreme 5.0 performance enhancements translate to significant added value because they can process increasing e-mail volumes without changing their current infrastructure.”

BorderWare has more closely integrated MXtreme into corporate directory services to improve its ability to provide real-time directory lookups. This allows any updates to the directory to be automatically recognized by MXtreme 5.0, removing the need to update disparate systems on a continuous basis.

Mxtreme 5.0 also adds Objectionable Content Filtering, an end user-manageable list that can be customized to meet the specific needs of any organization.

The rules can also be applied to both inbound and outbound messages in order to stop unwanted content from entering an organization and prohibiting sensitive information from leaving an organization.

Also included is the ability to customize the lists in accordance with specific compliance requirements such as HIPAA, Sarbanes Oxley and PIPEDA.

Finally, BorderWare has upgraded the administrator and user interfaces to be easier to use.

http://www.messagingpipeline.com/showArticle.jhtml?articleID=162100577

Read more

Juniper Targets Cisco With Security Strategy

Posted on by admini

Juniper, which is expected to make the announcement at the Interop show in Las Vegas, will also outline a broad network security framework that it plans to fill out over the next few years.

The framework planned by Juniper gives IT managers a potential alternative to Cisco’s emerging Network Admission Control (NAC) technology and the Network Access Protection offering that Microsoft Corp. is developing.

Overall, the move to integrate security functions into the network layer is a good thing, said Hugh McArthur, director of information systems security at Online Resources Corp., a Chantilly, Va.-based online bill-processing firm. The security functions being delivered at the network layer also need to mature more before many users will feel confident enough to enable the automated responses to network threats and attacks that the technologies support, said Eric Beasley, senior network manager at Baker Hill Corp. in Carmel, Ind.

David Flynn, vice president of products for Juniper’s security tools and network-access routers, acknowledged that completely delivering on the Enterprise Infranet vision will be a multiyear process.

Another key difference is that Cisco is integrating the security into its networking equipment, while Juniper is offering its tools as an “overlay solution” designed to work with a mix of network gear, said Robert Whiteley, an analyst at Forrester Research Inc.

http://www.computerworld.com/networkingtopics/networking/story/0,10801,101450,00.html

Read more

Microsoft Puts IE Enhancements on Fast Track

Posted on by admini

“We made the decision that the things we were doing wouldn’t just be in Longhorn and that we needed to get them into the hands of the current installed base as well. IE 7 is down-level to [Windows] XP, even though somewhat of a superset of it is the browser in Longhorn,” said Microsoft Chairman and Chief Software Architect Bill Gates in an interview at WinHEC here last week.

In Longhorn, IE will run in its own protected space, thus isolating it from other parts of the operating system.

But even before Longhorn hits, Microsoft is adding several security enhancements to IE 7.0, which is due in beta this summer. The newest version of the browser will have technology to prevent cross-domain scripting, and the default mode will be one with a reduced privilege level to help prevent attackers from using IE as a stepping-off point for other attacks.

Version 7.0 may also include integration with Microsoft’s nascent anti-spyware technology, which is in beta.

“But, if you consider that IE is probably one of the most-used products and has the most access to untrusted systems on the Internet, it kind of makes some sense to almost have IE behave like a bastion host,” Robert said.

Matthew Patton, a network security engineer in Arlington, Va., said he does not believe Microsoft’s moves will be very effective. “Cross-domain scripting, for example, is a problem local to IE, and isolating IE from the operating system doesn’t change anything in that regard,” Patton said.

The Redmond, Wash., software maker is entering the third decade of Windows computing, which really became pervasive in its second decade with the release of Windows 95.

Virtualization is another key technology for Microsoft, and the company will be building that support into Windows, making sure the emulation is “very, very efficient,” Gates said. Microsoft must be careful that the VM does not become a security weakness through which an attacker could insert a VM under the operating system, negating Windows’ security protections, Gates said. “So the operating system will have to become enabled to be able to look down and have what’s called a chain of trust where it looks if it is a trustworthy [VM] running on trustworthy hardware.”

http://www.eweek.com/article2/0,1759,1791107,00.asp?kc=EWRSS03119TX1K0000594

Read more