Month: June 2005

Cisco Buys Security Vendor NetSift For $30 Million

Posted on by admini

San Diego-based NetSift, a privately held, 15-employee company founded in June 2004, would add technology for deep packet processing.

On its Web site, venture capital firm Enterprise Partners Venture Capital lists NetSift on its software portfolio and describes the company as a developer of systems to protect enterprises from large-scale worm and virus attacks.

Cisco said the deal is slated to close in its fiscal fourth quarter ending July 30.

http://www.crn.com/showArticle.jhtml;jsessionid=C1DOYN21IMR3AQSNDBNCKH0CJUMEKJVN?articleID=164902960

Read more

Feds Face Deadlines on Smart ID Cards

Posted on by admini

All major agencies are required to submit implementation plans to the White House Office of Management and Budget that describe how they intend to meet the smart-card requirements outlined in Federal Information Processing Standard 201. The cards must support two-factor authentication via digital certificates, a password or personal identification number, and biometric identifiers.

The effort required for most agencies to conform to the mandates makes meeting the two October deadlines “very challenging,” said John Moore, chairman of the Federal Smart Card Project Managers Group and director of the Office of Governmentwide Policy at the General Services Administration in Washington.

Because the Personal Identity Verification (PIV) cards will control access to both physical and IT assets, IT departments within agencies have to work with their counterparts on the physical security side, as well as with badging and access-control staffers and human resources personnel, Moore said. The specification is designed to make the smart cards more interoperable than existing ones, said Curt Barker, NIST’s FIPS-201 program manager.

For instance, the U.S. Department of Defense has rolled out more than 4 million of the previous-generation cards. Although Barker said the transition is intended to be “evolutionary,” he noted that agencies such as the DOD could find things “a bit more complex” than agencies that are implementing smart-card technology for the first time.

Some of the technical details of the smart cards themselves are still in draft form, said Neville Pattison, director of technology and government affairs at Axalto Inc., a smart-card manufacturer in Austin. Large-scale manufacturing of PIV cards is unlikely to happen before the second half of next year, said Pattison, who was on a team that acted as a liaison between agencies and technology vendors.

http://www.computerworld.com/securitytopics/security/story/0,10801,102778,00.html

Read more

Gartner: Relax about overhyped security threats

Posted on by admini

Lawrence Orans, a principal research analyst, and John Pescatore, vice president and research fellow, told attendees at the Gartner IT Security Summit in Washington, D.C., not to fear going ahead with projects that use voice over IP technology, Virtual Private Networks over the Internet and wireless hot spots. The computer-security experts also advised their audience not to waste time or money on products they don’t need to meet federal regulations and protect against malware on mobile devices.

The men debunked five popular security myths:

* Eavesdropping risks makes VOIP telephony too insecure to use. Industry and the media overhype the danger of eavesdropping because it is as easy to eavesdrop on voice packets in a network as on data packets, Orans said. Companies that follow best practices to protect their data should have no trouble protecting their Internet telephony operations”.

* Malware on mobile devices will cause major business disruptions in the near future. The hype about antivirus products to protect cell phones and PDAs has been around since 2001, Pescatore said. But he said he predicted that viruses and other malware used against wireless mobile devices won’t cost more than antivirus protections against them until the end of 2007 at the earliest. More Americans need to use smart phones and PDAs with always-on wireless capability, Pescatore said. Additionally, mobile malware attacks won’t become a real threat until the users of these wireless items commonly send locally executed software”, he said.

* Viruses will not destroy the Internet. Named after Andy Warhol’s “15 minutes of fame” quip, a Warhol worm infects all vulnerable computers on the Internet within 15 minutes, Orans said.

* Compliance with government regulations equals security. The increased federal regulation prompted by Sarbanes-Oxley and similar legislation does not automatically lead to more security.

* Wireless hot spots are unsafe. The threat of “evil twins” setting up rogue access points to fool unsuspecting Internet users into thinking they are on real sites and then divulging confidential information is a red herring.

http://www.fcw.com/article89119-06-07-05-Web

Read more

Mass TCP Port Attack Could Be Imminent, Analyst Warns

Posted on by admini

In Windows 2000, Windows XP and Windows Server 2003, Microsoft uses TCP Port 445 to run SMB directly over TCP/IP to handle the sharing of files, printers, serial ports, and also to communicate between computers.

She said software engineers at Redmond would continue to analyze and monitor for any malicious activity but stressed that she was not aware of any customers being attacked via sniffing against TCP Port 445 and have not received any indication of malicious activity associated with MS05-027.

John Pescatore, VP of security research at Gartner Inc., said the reports of increased sniffing on Port 445 are a “serious concern for enterprise security managers” because such activity usually means a mass attack is imminent.

“[Administrators must] immediately review all firewall policies (including those covering personal firewall software) to ensure that Port 445 access is blocked wherever possible [and] update all intrusion prevention system filters (both network- and host-based) to block attempts to exploit this vulnerability,” Pescatore added.

http://www.eweek.com/article2/0,1759,1830698,00.asp?kc=EWRSS03119TX1K0000594

Read more

SMBs Urged to Take Security Steps

Posted on by admini

One of several seminars being featured during Ziff Davis Internet’s SMB (small and midsize business) Solutions Virtual Tradeshow, a hot-button virtual panel titled “Security Priorities: Getting the Most Protection for Your Dollar” featured three presenters.

Each presenter examined different aspects of the SMB security issue, along with polls and a question-and-answer interactive box for participants to type in questions relating to the topic.

The first speaker, Michael Grieves, consulting partner for channel strategies firm Core Strategies and director of research of the MIS department at the University of Arizona, said that because smaller businesses don’t have the resources of their larger brethren, members of such organizations “have got to go look in the mirror” to find somebody to handle their security needs, adding that it is a fairly lonely proposition. Grieves went on to present a set of what he called “realistic security steps” that SMBs can use to protect themselves and to sense and respond to incidences without needing the sorts of resources to which larger enterprises have access. According to Grieves, these four steps are making IT security a priority; taking obvious steps such as keeping systems up-to-date and implementing virus protection; being paranoid about security; and developing an emergency plan of action before any emergencies arise.

John Norman, a systems engineer at Advanced Systems Group, focused on sensible security strategies for SMBs, said that perhaps the biggest problem SMBs face in developing a security strategy is one of prioritization. In determining these priorities, Norman noted that it may not be feasible to protect some of a company’s assets and to weigh security costs against the time, money and convenience required.

SMBs may need to hire consultants to obtain expertise and outsource such services as regular audits and firewall maintenance, he said.

Meanwhile, Forrester Research analyst Paul Stamp discussed data his group has collected about the importance of security among SMBs. According to Stamp, about 28 percent of North American SMBs spend between 2 percent and 4 percent of their budgets on IT security, while another 28 percent spent less than 2 percent. In addition, about 12 percent of decision-makers for the SMBs Stamp surveyed “didn’t know” how much their companies spent on security.

http://www.eweek.com/article2/0,1759,1830641,00.asp?kc=EWRSS03119TX1K0000594

Read more

Targeted Trojan-horse attacks hitting U.S., worldwide

Posted on by admini

This week, security company Symantec sorted through low-volume e-mail threats submitted to its response team for analysis and found several that had targeted U.S. government agencies or had been submitted to Symantec from government sources in the United States. Two programs that fit the profile–identified by Symantec as Trojan.Mdropper.B and Trojan.Riler.C–were among the threats warned about by the NISCC.

Last month, law enforcement agencies in Israel found that private detectives had allegedly used targeted Trojan-horse programs to steal information from their clients’ competitors, according to press reports.

The latest attacks are targeted at only a few companies or government agencies at a time and show signs of significant background research into the target, said Mark Sunner, chief technology officer for e-mail security firm MessageLabs.

While data on the attacks is scarce, with the company only detecting two attacks per week, they are a serious threat, he said.

The United States Computer Emergency Readiness Team, or US-CERT, has not released a statement on the NISCC advisory.

The stealthy attacks have frequently been sent to a specific person at the targeted organization and show that attackers are researching the best way to convince the victim that the document containing the Trojan horse is real. Moreover, tradition e-mail-borne mass-mailing viruses typically have not stolen documents. Both MyFip and the latest string of attacks discovered by MessageLabs and NISCC appear to come from China.

http://www.securityfocus.com/news/11222

Read more