Skip to content

CyberSecurity Institute

Security News Curated from across the world

Menu
Menu

Month: January 2006

Create an e-annoyance, go to jail

Posted on January 9, 2006December 30, 2021 by admini

This ridiculous prohibition, which would likely imperil much of Usenet, is buried in the so-called Violence Against Women and Department of Justice Reauthorization Act.

Criminal penalties include stiff fines and two years in prison.

“The use of the word ‘annoy’ is particularly problematic,” says Marv Johnson, legislative counsel for the American Civil Liberties Union. “What’s annoying to one person may not be annoying to someone else.”

A new federal law states that when you annoy someone on the Internet, you must disclose your identity. “Whoever…utilizes any device or software that can be used to originate telecommunications or other types of communications that are transmitted, in whole or in part, by the Internet… without disclosing his identity and with intent to annoy, abuse, threaten, or harass any person…who receives the communications…shall be fined under title 18 or imprisoned not more than two years, or both.”

Buried deep in the new law is Sec. 113, an innocuously titled bit called “Preventing Cyberstalking.” It rewrites existing telephone harassment law to prohibit anyone from using the Internet “without disclosing his identity and with intent to annoy.” The bill cleared the House of Representatives by voice vote, and the Senate unanimously approved it Dec. 16.

An earlier version that the House approved in September had radically different wording. It was reasonable by comparison, and criminalized only using an “interactive computer service” to cause someone “substantial emotional harm.”

Think about it: A woman fired by a manager who demanded sexual favors wants to blog about it without divulging her full name. An aspiring pundit hopes to set up the next Suck.com. A frustrated citizen wants to send e-mail describing corruption in local government without worrying about reprisals. In each of those three cases, someone’s probably going to be annoyed. That’s enough to make the action a crime. (The Justice Department won’t file charges in every case, of course, but trusting prosecutorial discretion is hardly reassuring.)

Clinton Fein, a San Francisco resident who runs the Annoy.com site, says a feature permitting visitors to send obnoxious and profane postcards through e-mail could be imperiled. He added: “If you send an annoying message via the United States Post Office, do you have to reveal your identity?” Fein once sued to overturn part of the Communications Decency Act that outlawed transmitting indecent material “with intent to annoy.” But the courts ruled the law applied only to obscene material, so Annoy.com didn’t have to worry. “I’m certainly not going to close the site down,” Fein said on Friday. “I would fight it on First Amendment grounds.”

Our esteemed politicians can’t seem to grasp this simple point, but the First Amendment protects our right to write something that annoys someone else. It even shields our right to do it anonymously. U.S. Supreme Court Justice Clarence Thomas defended this principle magnificently in a 1995 case involving an Ohio woman who was punished for distributing anonymous political pamphlets. If President Bush truly believed in the principle of limited government (it is in his official bio), he’d realize that the law he signed cannot be squared with the Constitution he swore to uphold. And then he’d repeat what President Clinton did a decade ago when he felt compelled to sign a massive telecommunications law. Clinton realized that the section of the law punishing abortion-related material on the Internet was unconstitutional, and he directed the Justice Department not to enforce it. Bush has the chance to show his respect for what he calls Americans’ personal freedoms. Now we’ll see if the president rises to the occasion.

http://news.com.com/Create+an+e-annoyance%2C+go+to+jail/2010-1028_3-6022491.html?part=rss&tag=6022491&subj=news

Read more

Firms offshoring to India urged to review security

Posted on January 9, 2006December 30, 2021 by admini

Subramaniam Ramadorai, chief executive of Indian IT services giant TCS, said that firms should also mitigate risk by ensuring they have backup sites at multiple locations.

Martyn Hart of the UK’s National Outsourcing Association said further attacks could cause companies to avoid developing their own sites in favour of outsourcing work to Indian service providers with established security procedures. Further attacks could also discourage Western managers from visiting Indian sites to better integrate onshore and offshore work.

http://www.itweek.co.uk/itweek/news/2148252/firms-offshoring-india-urged

Read more

Three more U.S. states add laws on data breaches

Posted on January 6, 2006December 30, 2021 by admini

For companies that do business nationally or in various states, the smorgasbord of state laws poses a growing problem, because the measures often specify different triggers for notifications and set varying requirements on what needs to be disclosed, to whom and when, said Kirk Herath, chief privacy officer at Nationwide Mutual Insurance Co. in Columbus, Ohio.

In addition, some states require companies to provide credit-monitoring services to affected customers, whereas others don’t, Herath said.

http://www.networkworld.com/news/2006/010606-data-breaches-law.html

Read more

Why Asset-Based Security Makes Sense

Posted on January 6, 2006December 30, 2021 by admini

Processes, procedures and tactical operations must be driven by strategic goals based on your critical assets to ensure that the security program is in step with the enterprise’s business needs. As a result of this alignment with business needs, a strategic security program will enable business and provide tangible metrics to demonstrate its effectiveness.

In an asset-based security program, the information gained by each operational process is tied to the relevant assets. By focusing on the critical assets that your security program is in place to protect, you put in place an underlying foundation that individual security processes can link into. Think of your assets as being the “glue” that holds together a strategic security program, allowing the information gained by one individual process to be readily utilized to by the other processes. And by enabling the flow of information between security processes that are typically isolated “information silos,” you set in place the mechanism that drives continuous improvement across your entire security program.

Tactically speaking, asset-based security allows you to better manage operational workflow by pointing out which security efforts would reduce the most risk. A few days before, several vulnerabilities were publicly disclosed detailing exploitable flaws in your databases. During peak business hours, your IDS detects many possible incidents including a buffer overflow attack directed at your R&D database server. Because your security program is integrated around your assets, the R&D database server is immediately recognized as a highly critical asset that, according to the newly disclosed vulnerability data and ongoing vulnerability scans, is vulnerable to the buffer overflow attack detected by your IDS. The incident stands out from the rest of the alerts and is escalated as the highest priority and your security team reallocates their resources to mitigate the threat immediately, maintaining the integrity of your intellectual property.

Strategically speaking, an asset-based security program keeps intruders out by ensuring that all individual security processes are focused on what matters most to your business-the risk faced by your critical assets. Regardless of what the preferred method of attack will be in the future, the target will still remain the same.

http://www.net-security.org/article.php?id=888

Read more

Security flaws on the rise, questions remain

Posted on January 5, 2006December 30, 2021 by admini

The most important, and perhaps obvious, lesson is that the software flaws are here to stay, said Peter Mell, a senior computer scientist for the National Institute of Standards and Technology (NIST) and the creator of the National Vulnerability Database (NVD), one of the four databases surveyed. “The problem of people breaking into computers is not going away any time soon,” Mell said. “There is certainly more patches every year that system administrators need to install, but the caveat is that more vulnerabilities seem to apply to less important software.”

In 2005, NIST created the National Vulnerability Database and software makers and security service providers have cooperated to create the Common Vulnerability Scoring System (CVSS), a standardized measure of the severity of software flaws. The National Vulnerability Database completed scoring flaws in its database using the CVSS in late November.

Four databases were surveyed: The Computer Emergency Response Team (CERT) Coordination Center’s database, the National Vulnerability Database (NVD), the Open-Source Vulnerability Database (OSVDB), and the Symantec Vulnerability Database.

The number of flaws cataloged by each database in 2005 varied widely, because of differing definitions of what constitutes a vulnerability and differing editorial policy. The OSVDB–which counted the highest number of flaws in 2005 at 7,187–breaks down vulnerabilities into their component parts, so what another database might classify as one flaw might be assigned multiple entries.

SecurityFocus had the lowest count of the vulnerabilities at 3,766.

The variations in editorial policy and lack of cross-referencing between databases as well as unmeasurable biases in the research community and disclosure policy mean that the databases–or refined vulnerability information (RVI) sources–do not produce statistics that can be meaningfully compared, Steve Christey, the editor of the Common Vulnerability and Exposures (CVE), wrote in an e-mail to security mailing lists on Thursday. The CVE is a dictionary of security issues compiled by The MITRE Corp., a government contractor and nonprofit organization. “In my opinion, RVI sources are still a year or two away from being able to produce reliable, repeatable, and comparable statistics,” he wrote. “In general, consumers should treat current statistics as suggestive, not conclusive.” Recent numbers produced by the U.S. Computer Emergency Readiness Team (US-CERT) revealed some of the problems with refined vulnerability sources. Some mainstream media outlets noted the number, compared it to the CERT Coordination Center’s previous data–which is compiled from a different set of vulnerability reports–and concluded there was a 38 percent increase in vulnerabilities in 2005 over the previous year. In fact, discounting the updated reports resulted in a 41 percent decrease to 3,074 vulnerabilities, according to an analysis done by Alan Wylie, an independent computer programmer. If the data point could be compared with statistics from CERT/CC, that would have placed the number of flaws reported in line with the previous three years. The computer scientist conducted an informal survey of entries for flaws in products from well-known companies and found that six of 14 software makers had seen a doubling in the number of vulnerability reports, while another four firms saw a decrease in the number of reports.

http://www.securityfocus.com/news/11367?ref=rss

Read more

Mobile malware, phishing activities to surge in 2006

Posted on January 5, 2006December 30, 2021 by admini

The perception that the threat of mobile malware was much less than that of its PC counterpart would encourage virus writers to come up with even more sophisticated threats, the McAfee AVERT Labs added.

Apart from mobile malware, phishing scams would also continue to rise this year, with attacks to become more targeted through the use of spyware programs and password stealers, McAfee AVERT Labs said.

http://news.inq7.net/infotech/index.php?index=1&story_id=62081

Read more

Posts navigation

  • Previous
  • 1
  • …
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • Next

Recent Posts

  • AI/ML News – 2024-04-14
  • Incident Response and Security Operations -2024-04-14
  • CSO News – 2024-04-15
  • IT Security News – 2023-09-25
  • IT Security News – 2023-09-20

Archives

  • April 2024
  • September 2023
  • August 2023
  • July 2023
  • June 2023
  • April 2023
  • March 2023
  • February 2022
  • January 2022
  • December 2021
  • September 2020
  • October 2019
  • August 2019
  • July 2019
  • December 2018
  • April 2018
  • December 2016
  • September 2016
  • August 2016
  • July 2016
  • April 2015
  • March 2015
  • August 2014
  • March 2014
  • August 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • October 2012
  • September 2012
  • August 2012
  • February 2012
  • October 2011
  • August 2011
  • June 2011
  • May 2011
  • April 2011
  • February 2011
  • January 2011
  • December 2010
  • November 2010
  • October 2010
  • August 2010
  • July 2010
  • June 2010
  • May 2010
  • April 2010
  • March 2010
  • February 2010
  • January 2010
  • December 2009
  • November 2009
  • October 2009
  • September 2009
  • June 2009
  • May 2009
  • March 2009
  • February 2009
  • January 2009
  • December 2008
  • November 2008
  • October 2008
  • September 2008
  • August 2008
  • July 2008
  • June 2008
  • May 2008
  • April 2008
  • March 2008
  • February 2008
  • January 2008
  • December 2007
  • November 2007
  • October 2007
  • September 2007
  • August 2007
  • July 2007
  • June 2007
  • May 2007
  • April 2007
  • March 2007
  • February 2007
  • January 2007
  • December 2006
  • November 2006
  • October 2006
  • September 2006
  • August 2006
  • July 2006
  • June 2006
  • May 2006
  • April 2006
  • March 2006
  • February 2006
  • January 2006
  • December 2005
  • November 2005
  • October 2005
  • September 2005
  • August 2005
  • July 2005
  • June 2005
  • May 2005
  • April 2005
  • March 2005
  • February 2005
  • January 2005
  • December 2004
  • November 2004
  • October 2004
  • September 2004
  • August 2004
  • July 2004
  • June 2004
  • May 2004
  • April 2004
  • March 2004
  • February 2004
  • January 2004
  • December 2003
  • November 2003
  • October 2003
  • September 2003

Categories

  • AI-ML
  • Augment / Virtual Reality
  • Blogging
  • Cloud
  • DR/Crisis Response/Crisis Management
  • Editorial
  • Financial
  • Make You Smile
  • Malware
  • Mobility
  • Motor Industry
  • News
  • OTT Video
  • Pending Review
  • Personal
  • Product
  • Regulations
  • Secure
  • Security Industry News
  • Security Operations
  • Statistics
  • Threat Intel
  • Trends
  • Uncategorized
  • Warnings
  • WebSite News
  • Zero Trust

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org
© 2025 CyberSecurity Institute | Powered by Superbs Personal Blog theme