May 2006 – Page 6 – CyberSecurity Institute

Should IT security be separate from IT?

Posted on May 13, 2006December 30, 2021 by admini

For 2006, security is no longer the most pressing of the IT issues; it does, however, remain a major consideration. Security affects many aspects of IT — operational, complexity and risks of IT systems and measurement of value, to name just a few examples. If an organisation had a separate IT security department, this department would be solely responsible for not only the selection and maintenance of IT security solutions, but also for approving the new solutions requested by the IT department and the rest of the business. This responsibility is taken away from the IT department, leaving it to concentrate on fulfilling the organisation’s objectives.

http://amch.questionmarket.com/jsc/jsc.html?s=19&c=16325408&v=240460&

Oracle platform targets security

Posted on May 12, 2006December 30, 2021 by admini

Provisioning software provides a platform for giving users access to resources based on a set of roles and rules and an audit trail for who has access to what and when.

Identity Manager R3 is the first in a series of software releases that will continue this summer when the company updates its federation software (acquired from Phaos in 2004 and Oblix in 2005), its access-management software (Oblix) and its virtual directory technology (acquired from OctetString in 2005).

Oracle’s short-term goal is to deliver incremental upgrades to the components of its identity-management suite but the ultimate goal is to align all the software under a common architecture. “I’d characterize Oracle as having established communication among these components, but not yet integration and functional rationalization,” says Jonathan Penn, an analyst with Forrester Research. Oracle faces the same chore as many other vendors, which is tying together a collection of software garnered through acquisition into an identity platform with common underpinnings such as a single workflow engine. “Oracle plans to be out front, and their plan is clearly to be a leader in this marketplace,” says Roberta Witty, an analyst with Gartner.

http://www.networkworld.com/news/2006/051506-oracle-security.html?WT.svl=bestoftheweb1

Congress may slap restrictions on SSN use

Posted on May 11, 2006December 30, 2021 by admini

One bill, sponsored by Massachusetts Democrat Edward Markey, would require the FTC to make new rules limiting the sale and purchase of those identifiers, with exceptions for law enforcement, public health, certain emergency situations and selected research projects.

Another measure, sponsored by Florida Republican Clay Shaw, would restrict the display of SSNs on credit reports and on various government-issued documents and identification tags.

Several federal laws, including the Fair Credit Reporting Act and the Health Insurance Portability and Accountability Act, better known as HIPAA, also include restrictions on use and disclosure of the identifiers.

http://news.com.com/Congress+may+slap+restrictions+on+SSN+use/2100-7348_3-6071441.html?tag=nefd.top

A $15 Million Penalty

Posted on May 11, 2006December 30, 2021 by admini

“Victims are protected by federal law from having to pay the fraudulent charges, so the loss is primarily of time,” says Beth Givens, founder of the nonprofit Privacy Rights Clearinghouse.

Attorneys at the FTC are still working out exactly which losses will be covered.

One qualified expense: the cost of credit monitoring for victims who discovered the fraud before ChoicePoint notified them of the breach and offered free credit monitoring.

http://www.csoonline.com/read/040106/penalty.html

Execs tell regulators Sarbanes-Oxley costs exceed benefits

Posted on May 11, 2006December 30, 2021 by admini

The SEC and PCAOB arranged the roundtable to solicit feedback about Section 404 of the legislation, which requires companies to attest to the effectiveness of internal controls put in place to protect financial reporting systems and processes. “In practice it hasn’t always worked out that way,” he acknowledged.

Over the course of five panel discussions, participants shared their experiences with the internal control reporting requirements.

http://www.networkworld.com/news/2006/051106-sox-costs.html

MS Researchers Tackle Automated Malware Classification

Posted on May 11, 2006December 30, 2021 by admini

A research paper presented by Microsoft’s lead anti-virus researcher, Tony Lee, described the existing process of manual human malware analysis as “inefficient and inadequate” and suggested an ambitious method that combines runtime behavior analysis, static binary analysis and adaptable algorithms to automate classification. “[We believe] that an effective classification method can serve better detection, cleaning and analysis solutions,” Lee said.

http://www.eweek.com/article2/0,1895,1961132,00.asp