Month: June 2005

Phishing Up By 226 Percent

Posted on by admini

IBM’s monthly security report said that phishing jumped 226 percent in May over the previous month to record an all-time high that beat out the earlier record in January of this year.

The surge continued into and through June, said Redwood City, Calif.-based Postini in its own malicious code accounting, with phishing attacks climbing 71 percent over May’s numbers.

“Phishing attempts will continue to plague enterprise users for the foreseeable future,” opined Andrew Lochart, senior director of marketing at Postini, in a statement.

News of most other malware categories was almost as dismal. IBM, for instance, tallied a 33 increase during May in the number of e-mails carrying viruses or worms.

Spam remained flat at around 69 percent of all e-mail for May, said IBM, the third month in a row of little or no growth in junk mail.

http://www.techweb.com/wire/security/164904277

Read more

Senate Ponders Toughest Data Protection Bill Yet

Posted on by admini

Arlen Specter (R-Pa.), the chairman of the Judiciary Committee, and that committee’s ranking member, Sen. Patrick Leahy (D-Vt.) rolled out the most aggressive bill yet in reaction to the wave of security gaffes that have exposed millions of Americans’ identities since the first of the year.

Among its provisions, the Personal Data Privacy and Security Act of 2005 would create a new computer crime classification — aggravated fraud — that would add two years of additional jail time for obtaining or access another’s digital ID; severely restrict the use of Social Security numbers as account identifiers or numbers; and hold company executives responsible if they hide a data breach.

Both Leahy and Specter predicted quick passage of the bill, which is the first to sport a Republican as sponsor.

Several other bills that take on the data exposure problem have come from several prominent Democrats, including Dianne Feinstein (D-Calif.) and Charles Schumer (D-N.Y.).

— Add new penalties to the books by extending computer fraud to cover unauthorized access of data brokers’ systems (the statute already covers financial institutions and credit card issuers), meaning that criminals could face up to 10 years in jail; giving the government the power to invoke racketeering charges using the RICO statue to prosecute criminal gangs trading in identities; and putting company officials in prison for up to 5 years if they conceal a data breach.

— Enact a bevy of new regulations that cover “data brokers,” defined as business or non-profits “in the practice of collecting, transmitting, or otherwise providing personally identifiable information on a nationwide basis on more than 5,000 individuals.”

Among the regulations: data brokers would have to allow consumers the chance to change their information, and as with a credit report, receive a copy of that information at their request.

— Require businesses not already covered by the Gramm-Leach-Bliley Act or HIPPA (Health Insurance Portability and Accountability Act of 1996) to create a data privacy and security program.

That part of the Leahy-Specter bill also expands disclosure rules nationwide, and mandates that customers be informed of any security breach involving more than 10,000 people, or that revolved around a database with more than a million entries. And forces the General Services Administration (GSA) to review government contractors’ the privacy and security programs before awarding contracts.

http://www.techweb.com/wire/security/164904367

Read more

Australian banks warn of new scam

Posted on by admini

The emails, which pretend to be from either the National Australia Bank (NAB) or ANZ, direct customers to fake internet sites.

ANZ spokesman Paul Edwards said the bank had identified the “phishing” scam, which triggers the release of a trojan – a program that installs and runs on the victim’s computer – after they click on the website link. Both banks said they had alerted customers through their websites and were working with the Australian Federal Police to have the fake internet sites taken down. Edwards said the ANZ was still investigating the extent of the hoax while Sabin said the NAB had already received 200 emails from customers alerting it to the scam.

http://www.xatrix.org/article3921.html

Read more

India To Tighten Data-Secrecy Laws

Posted on by admini

The scandal has shaken India’s booming outsourcing industry, which provides telemarketing services, call center operations, payroll accounting, and credit card processing for hundreds of Western companies.

The government’s actions follow a report last week by a British newspaper that an Indian call center employee allegedly supplied details on the Britons’ bank accounts, credit cards, passports and drivers’ licenses to an undercover reporter for the Sun newspaper.

Karan Bahree was sacked from his job at Web designer Infinity eSearch on Saturday after the tabloid said it paid Bahree 3 pounds (US$5.40; euro4.20) for each person’s details, which included phone numbers, addresses, and pass codes.

NASSCOM said it is building a central database of all outsourcing industry employees to prevent criminals from getting jobs in the sector and threatening the data security of global companies.

http://www.securitypipeline.com/164903890

Read more

Security Execs: Under Pressure and Under Prepared

Posted on by admini

Nearly 100 percent of CSOs say they are well prepared to handle spam, malware, denial-of-service attacks, and hacker attacks, according to a survey by CSO Interchange at a conference held last week in Chicago for chief security officers.

The same survey also shows that 88 percent say their organizations are least prepared to handle inadvertent loss of data, social engineering and inappropriate use.

On top of that, another 75 percent report that their jobs have become more difficult or substantially more difficult than they were last year.

”The role of the CSO continues to become more complex,” says Philippe Courtot, co-founder of CSO Interchange and CEO of Qualys. ”CSOs now have responsibility for internal and external threats, compliance with regulatory mandates, and attention to bottom line business performance:.

The survey also shows:
– Sixty-four percent of CSOs surveyed are more concerned about compliance this year than they were last year, and 38 percent report their budget for compliance solutions grew during the past year;
– Seventy-four percent say their organization must comply with more than five laws and regulations;
– Sixty-eight percent say their security budget is less than 10 percent of their total IT budget; -Eighty-three percent outsource less than 10 percent of their security, and 40 percent do not outsource security processes at all, and
– Seventy percent say they do not receive sufficient early warning for cyberattacks.

http://itmanagement.earthweb.com/secu/article.php/3516156

Read more

CA buys firewall developer Tiny Software

Posted on by admini

Six-year-old, privately held Tiny had a staff of less than 20, all of whom have joined Islandia, New York-based CA, said Sam Curry, CA’s vice president of eTrust security management.

The acquisition closed in late May, and CA is continuing to sell Tiny’s software as stand-alone products.

Tiny also had an OEM (original equipment manufacturer) relationship with licensee customers, including Microsoft and Unisys (Profile, Products, Articles).

CA plans to incorporate Tiny’s firewall technology into its Integrated Threat Management platform, an under-development product CA plans to launch later this year. The idea is to bundle various desktop protection technologies into one system with a common interface. The platform will launch with CA’s antivirus and antispyware technology, and a later version will add Tiny’s firewall software, Curry said.

For now, Tiny Firewall is priced at US$50 per user for the desktop version and $200 for a server license, Curry said. Pricing may change when the software is added to CA’s Integrated Threat Management product, but CA also expects to continue offering the software as a stand-alone product, he said.

http://www.infoworld.com/article/05/06/27/HNcabuysfirewall_1.html

Read more