Month: November 2006

Security Management in Flux

Posted on by admini

Blum will talk about this and other security trends in his “Security Landscape: Market in Flux” session on Monday at the Computer Security Institute’s 33rd Annual Conference and Expo in Orlando, Fla.

This integration is also expected to simplify security oversight, with fewer tools and easier management of all that data they generate. “If you had one vendor provide everything for you, then it wouldn’t [be able to easily] keep up with change and new attacks,” he says. “And if you have too many different vendors’ products, you can’t keep up with the burden of integrating” it all and you’re probably not getting the best bang for your buck because you’ll also have to invest in integrating the tools.

The key is not getting trapped on a treadmill of having to buy a new security tool every time a new attack vector is discovered, or a new compliance requirement comes along, he says.

Meanwhile, there’s still no easy way to manage — nor sift through the false alarms — the data security tools generate. Today’s network operations centers don’t typically encompass all of an organization’s security management, “Most of us don’t have security in the NOC. You see security teams playing more strategic roles than operations, such as compliance, high-level risk management, etc. And they need to be able to exert control through distributed points as well… You can’t do it all from one NOC.”

http://www.darkreading.com/document.asp?doc_id=109786&WT.svl=news1_3

Read more

Review of The 6th Annual InfoSecurity New York Conference and Exhibition

Posted on by admini

Among the solutions provided, there exist data encryption, IT auditing services, application security solutions, biometrics, end-to-end infrastructure management… Whether your institution requires simple IT risk assessment or a full-enterprise database infrastructure centralization and standardization, InfoSec NY provided a complete spectrum of provider solutions.

In a world where both threats and solutions are constantly evolving, educating yourself about the various security providers available is no longer an issue of compliance and best-practices. InfoSec NY provided both elements by offering informative sessions hosted by field experts and other authorities in addition to vendor resources.

Out of the companies surveyed, the study found 72 percent of breaches occurred because of a lack of protection. Yet regardless of this fact, the costs caused by breaches are primarily reactive, with costs increasing with relation to collateral mitigation, such as:

– a 55 percent focus in marketing costs
– a 34 percent focus in customer support costs
– an 11 percent focus in legal, audit, and risk management cost
– a 0 percent focus in IT security costs

With the IT department bearing none of the costs related to addressing data breaches, such a trend will continue for those who do not maintain a best-practices information security posture.

From attending InfoSec NY, the tracks available satisfied every information security need for all financial institutions, whether they attended to simply touch base with the industry trends, or to gain insightful methods into improving their business posture. As for the general atmosphere of the discussion panels, the warm reception and the number of pleased nods the sessions provoked was a good indicator of the audience’s approval.

http://www.bankinfosecurity.com/articles.php?art_id=167&PHPSESSID=5d300b3be8332b81086b766592012ed5

Read more

MasterCard tackles PIN-based debit card fraud

Posted on by admini

A majority of banks currently use Fair Isaac Corp.’s Falcon fraud-detection system and their own homegrown systems for dealing with payment card fraud, she said. “But MasterCard, along with Visa, is in a better position to see networkwide transactions,” which can be an advantage in detecting fraud, Litan said.

MasterCard’s Online Fraud Monitor service will use a proprietary risk-scoring model that will look at factors such as account spending, transaction histories and device-level activity to calculate the likelihood of fraud on an individual ATM transaction, Sargent said. For instance, if a card that in the past has been used only domestically were to be used in a large transaction in a foreign country, the transaction would automatically be flagged as high-risk for follow-up action.

MasterCard already offers a similar fraud-detection capability for credit card and signature-based ATM transactions via its Expert Monitoring System and MasterCard Alerts services.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9004681&source=NLT_AM&nlid=1

Read more

Symantec Intros Anti-virus Software for Windows Mobile

Posted on by admini

While viruses attacking mobile devices remain rare, an increasing number of enterprises are handing out smart phones that store larger amounts of data, such as in mobile e-mail programs, driving the need for companies to adopt tools to protect sensitive corporate information traveling on the machines, according to Symantec.

In a recent survey completed by the Cupertino, Calif.-based company, some 80 percent of enterprises indicated that they have begun distributing smart phones, with 75 percent of those companies admitting they have yet to employ any form of mobile security software.

Despite the disparity, enterprises are beginning to shop for handheld anti-virus and security tools to avoid future security issues related to viruses and handhelds that go missing, said Paul Miller, managing director of mobile security at Symantec.

With Windows Mobile device adoption predicted to rise significantly over the next several years as smart phones become cheaper and more useful, the number of threats targeting the handhelds will likely increase as well, the executive said.

Along with the remote wipe-and-kill feature for what Miller refers to as “loss mitigation” in Mobile AntiVirus 4.0 for Windows Mobile, which allows users to delete information when they lose their device, the package boasts Symantec’s LiveUpdate Wireless service, which automatically updates phones’ threat protection signatures to combat emerging threats. The product also promises a centralized management feature that allows administrators to configure, lock, and enforce security policies on handsets from a single console interface.

http://www.smartdevicecentral.com/article/Symantec+Intros+Antivirus+Software+for+Windows+Mobile/192925_1.aspx

Read more