Month: December 2006

Virtual concerns

Posted on by admini

Multiple real servers can be consolidated into one larger, more powerful virtual server platform; just pack a single server with a lot of memory and a very fast CPU. But what’s coming on the virtual forefront is even more revolutionary. I know of one company that’s going to allow its employees to work from home using virtual images. The company will send the entire corporate image to the employee over a VPN connection, or at worst, on a single DVD.

Security experts and power users are using virtual machines to explore the riskier parts of the Internet without worry of host desktop modification. Banks and protection vendors are coming up with innovative solutions that involve sending virtual desktops to their online customers to prevent remote control bots from stealing PINs or fraudulently transferring bank balances.

First, because new virtual machines are so easy to create, administrators and operators aren’t treating them with the same security thoroughness as they do real metal and wire servers.

Second, if attackers break out of a VM into the host, they can immediately impact every other supported host on the server.

Third, anti-virus software and other scanners on the outside can’t easily scan inside virtual workstation images for worms, bots, and other threats.

Last, there are no comprehensive studies to prove how well a virtual machine protects against running malware.

Like instant messaging and USB thumb drives, the virtual revolution is coming whether you like it or not. Discuss the impact virtual machines will have on your environment, especially on security, with vendors and your technical staff.

http://www.infoworld.com/article/06/12/01/49OPsecadvise_1.html

Read more

New E-Discovery Rules Take Effect

Posted on by admini

E-mail has been used as evidence in court cases for years; the amended rules also cover electronic documents, spreadsheets, image and sound files, and database info.

The amended rules explicitly state that requested information must be turned over within 120 days after a complaint has been served on a defendant. If this deadline isn’t met, it’s possible that electronic evidence could be ruled inadmissible. Or in the instance of a defendant sitting on potentially damaging evidence, courts can levy fines and other penalties.

The amended rules are to CIOs what Sarbanes-Oxley was to CFOs, says Riki Fujitani, a former attorney who’s now president of IT service provider Hoike.

The courts are showing their understanding that information is much easier to retrieve from modern storage technologies, while at the same time acknowledging that finding the right information on obsolete media could be just as difficult as digging up a paper document in a warehouse of filing cabinets.

In a survey by Enterprise Strategy Group, 91% of 568 e-mail, database, and compliance pros at companies with more than 20,000 employees said their organizations had been issued a discovery request for e-mail last year.

One thing that’s anything but ambiguous is the legal system’s disdain for companies that intentionally destroy electronically stored information. Morgan Stanley in May paid $15 million to settle Securities and Exchange Commission charges that it destroyed more than 200,000 e-mails and failed to cooperate with SEC investigators looking into Wall Street business practices.

Courts have over the past six years or so changed their views on the credibility of electronic documents, says Diego Maldonado, senior VP of the government technology group within consulting firm The Newberry Group.

Despite the amendments, there are still gray areas related to e-discovery.

http://www.informationweek.com/news/showArticle.jhtml;jsessionid=TEDZYBQNAAK00QSNDLPCKH0CJUNN2JVN?articleID=196600853

Read more

Fortifying Identity Products

Posted on by admini

SiteMinder 6.0 SP5, which securely provisions access rights across the Internet as a key piece of CA’s IAM platform, now better supports so-called “strong authentication,” which includes tokens, smartcards and biometrics.

Along the lines of providing more choice, SiteMinder provides a new federation end point, which uses technology licensed from Ping Identity, to improve security provisioning among partners in the federation. “The idea of SiteMinder is that if you have a Web application that many business partners need to get to, you’ll need a hub a platform on which to support that federation,” Gardiner said.

SiteMinder, acquired through CA’s Netegrity purchase, is the key policy engine of CA’s IAM suite, but the company spruced up other pieces of its IAM suite.

In HP’s IdM suite, HP Select Audit software has been integrated with HP’s Select Identity, Select Federation and Select Access, adding audit, attestation, monitoring, alerting, reporting and archiving capabilities to those applications. HP conducted some integration and improvements to its own identity and access management software suite, according to Sai Allavarpu, director of product management and marketing for identity and security management at HP.

http://www.internetnews.com/ent-news/article.php/3646601

Read more