Author: admini

Outsourced security extends to wealth of services, study finds

Posted on by admini

“Companies are finding that the frequency and sophistication of threats is out of control for them to handle internally and they’re looking for service providers with competency to be able to handle that for them,” Kark said.

In the recent Forrester report: “Market Overview: Managed Security Services,” Kark lays out ways the broad industry is shaping out and what companies should look for in a service provider. To do that, companies need to evaluate a number of different kinds of MSSPs, from telecommunications providers that bundle security with their services, to value-added resellers and system integrators that provide a mixture of services.

Robert T. Ferrilli, president and CEO of the Ferrilli Information Group, turned over nearly all his systems to managed service providers when the company’s Exchange server went down unexpectedly while he was on a business trip. The firm, which provides business applications for universities and colleges, has a team of 20 developers spread out across the United States.

Many firms have a suite of services and are happy to sell everything they offer, but enterprises with a solid set of priorities of what they want to gain from a MSSP will be able to better evaluate what partner is right for them, Kark said. Instead of just gaining Web filtering or email protection, enterprises are seeking guidance from their MSSPs on security related issues, forcing some firms to invest in creating consulting services divisions. According to Kark, content security in the form of email and Web content filtering still has the most market penetration, but other technologies are quickly gaining ground.

Companies are outsourcing log management and event correlation and analysis services as well as distributed denial-of-service (DDoS) protection services. The growth of cloud computing, with more company data spread out beyond the company walls, has forced some firms to seek out specialized security providers.

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1508261,00.html?track=sy160&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+techtarget%2FSearchsecurity%2FSecurityWire+%28SearchSecurity+%3A+Security+Wire+Daily+News%29

Read more

Researchers expose complex cyber espionage network

Posted on by admini

Shadows in the Cloud documents a complex ecosystem of cyber espionage that systematically compromised government, business, academic, and other computer network systems in India, the Offices of the Dalai Lama, the United Nations, and several other countries. The report also contains an analysis of data which were stolen from politically sensitive targets and recovered during the course of the investigation.

Recovery and analysis of exfiltrated data, including one document that appears to be encrypted diplomatic correspondence, two documents marked “SECRET”, six as “RESTRICTED”, and five as “CONFIDENTIAL”. These documents are identified as belonging to the Indian government. However, we do not have direct evidence that they were stolen from Indian government computers and they may have been compromised as a result of being copied onto personal computers.

Just like the majority of targeted malware attacks, this one was also relying on client-side exploits (Report: Malicious PDF files comprised 80 percent of all exploits for 2009) served through different file types (PDF, PPT, DOC) using a relevant topic of interest to Indian and Tibetan communities, which were then spamvertised to the victims of interest.

What’s particularly interesting about the cyber espionage facilitating network in question, is the mix of legitimate and purely malicious infrastructure in an attempt to not only increase the life cycle of the campaign, but also, to make it harder for network administrators to detect the malicious use of popular free email service providers, as well as social networks. In fact, in 2009 cybercriminals continued demonstrating their interest in abusing legitimate services such as Twitter, Google Groups, Facebook as command and control servers, as well as Amazon’s EC2 as a backend.

Moreover, although the report is logically emphasizing on the actual attack vectors used in this particular cyber espionage network, there’s another attack vector that’s been trending over the past few years, having an identical cyber espionage potential to the targeted attacks in general.

http://blogs.zdnet.com/security/?p=6042

Read more

Microsoft Cyber Security Survey Finds Businesses’ Most Valuable Data at Risk

Posted on by admini

For instance, decision makers should identify which information is the most valuable.

Another smart move would be to “create a ‘risk register’ of data security risks [that] divides the risks your firm faces into two categories: compliance risks and misuse of secrets.”

The survey, which was carried out in November and December, polled 163 U.S.-based companies and 102 European companies, as well as 40 based in Australia and New Zealand.

http://www.esecurityplanet.com/trends/article.php/3874791/Microsoft-Cyber-Security-Survey-Finds-Businesses-Most-Valuable-Data-at-Risk.htm

Read more

Firms unprepared for new ICO powers

Posted on by admini

When things go wrong, a security breach can cause real harm and great distress to thousands of people,” said Information Commissioner Christopher Graham at the time. “UK businesses should take note of the new rules and ensure they have effective data protection compliance measures in place to meet the ICO’s standards,” he added.

Nugent suggested that the new powers may also pave the way for other measures under consideration, including potential prison sentences for criminal offences involving the misuse of personal data.

However, William Malcolm, an information law expert at international lawfirm Pinsent Masons, warned that the new powers represent a “step change” for the ICO that many firms may not be aware of. While this is a significant deterrent now, they need to make sure they carry out reviews of how personal data is handled, and implement sensible controls to ensure that data is protected,” he said.

The ICO has stepped up enforcement in recent years, and would undoubtedly have used the powers to deal with some of the cases it has dealt with over the past six months had they been available.”

Richard Turner, chief executive of data security firm Clearswift, agreed that education efforts need to be stepped up. “The ICO will have a wide scope of interpretation when applying its new regime, as the fines can be levied for breaches of principles, rather than against the underlying detailed legal requirements…The first few fines the ICO levies will therefore set the tone,” he said.

“While the largest fines may only be dealt out to larger companies for serious breaches of the DPA, all organisations are now faced with a very real threat of significant financial penalties over and above any existing operational clean up costs and reputational damage should they suffer a breach.”

http://www.v3.co.uk/v3/analysis/2260796/firms-warned-guard-ico-powers

Read more

Security spending survey finds misaligned IT security budgets

Posted on by admini

The survey found most security spending is driven by compliance initiatives, which focuses on protecting less valuable custodial data in the form of customer personally identifiable information and credit card numbers.

The data makes up a smaller proportion of a company’s assets, about 38%, while 62% of valuable enterprise assets typically make up corporate secrets.

“Catastrophic toxic data spills are dramatic and expensive, and they garner the most headlines…But for most enterprises, secrets are more valuable than custodial data,” according to the Forrester report, “The value of corporate secrets.”

Firms in the manufacturing, information services, professional, scientific and technical services and transportation accrue between 70% and 80% of their information portfolio value from corporate secrets. The survey found the average cost for lost smartphone incidents was about $12,000 per incident, while lost laptops and accidental leakages cost $26,000 per incident.

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1508039,00.html?track=sy160&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+techtarget%2FSearchsecurity%2FSecurityWire+%28SearchSecurity+%3A+Security+Wire+Daily+News%29

Read more

US, Europe, Japan agree on data center efficiency metric

Posted on by admini

“The Green Grid is working with organizations around the world to develop a clear and well-defined language for the way we communicate about energy efficiency metrics, which will give us a common measuring stick for all data centers regardless of their location,” said Tom Brey, an IBM employee who is secretary of The Green Grid, in a statement.

PUE, which was developed by the Green Grid, divides the total energy consumed by a data center by the amount of energy used to power the IT equipment. It has emerged as the most popular metric for measuring data center efficiency, and some large companies, notably Microsoft and Google, have been publishing PUE numbers as a way to show off the efficiency of their newest facilities.

“A global task force with representatives from each of the above mentioned organizations will continue to move this initiative forward and reconvene later this year to evaluate progress,” the Green Grid says in the statement.

In January representatives from the EPA met with several data center industry groups from the U.S., including 7×24 Exchange and ASHRAE (The American Society of Heating, Refrigerating and Air-Conditioning Engineers).

Rising energy costs and the amount of powerful IT equipment that has been added to data centers in recent years has made them a cost center on the radar of senior executives.

http://www.computerworld.com/s/article/9174701/US_Europe_Japan_agree_on_data_center_efficiency_metric?source=rss_news

Read more