admini – Page 148 – CyberSecurity Institute

U.S. proposes digital signing of DNS root zone file

Posted on October 10, 2008December 30, 2021 by admini

The operator of the .org TLD has also committed to the system, according to the Commerce Department.

But to get the full benefits of DNSSEC requires domain name registrars, domain name registries, Internet service providers and others to upgrade their software. “DNSSEC-signed root zone would represent one of most significant changes to the DNS infrastructure since it was created,” according to a notice issued by the Commerce Department in the Federal Register, a daily digest of U.S. government notices.

As it stands now, TLD operators send changes to the Internet Assigned Numbers Authority, which is part of the Internet Corporation for Assigned Names and Numbers. ICANN then sends the changes to the U.S. National Telecommunications and Information Administration, which is part of the Commerce Department. The heavy involvement of the U.S. government in how the Internet’s addressing system is administered, as well as the interests of VeriSign, has drawn criticism that the process is too U.S.-centric. And there appears to be a battle brewing over which entity will manage the cryptographic keys required to sign the root zone file.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9116900&source=NLT_PM&nlid=8

Spam Trends Down?

Posted on October 8, 2008December 30, 2021 by admini

“Addresses on Intercage’s network range were being used to host command and control channels for botnets,” Mark Sunner, chief security analyst at the messaging security specialist said in a report summary.

Overall, the company’s research group found that the global ratio of spam traffic from previously unknown sources reached 70.1 percent (1 in 1.43 e-mails) of all e-mail in September, a decrease of 8.1 percent compared to the previous month.

In the world of message-based malware threats, MessageLabs reported that over 45 percent of the infection-laden e-mails it filtered represented newly-created attacks. One in 288.1 (0.35 percent) of all e-mails intercepted by the researchers harbored some form of phishing attack during the month. However, compared to other threats including Trojans and botnets, the sheer number of phishing e-mails decreased by 29 percent to 45.7 percent of all message-based attacks tracked in September. Phishing levels for Q3 2008 were at their lowest level since Q2 2006 and have continued to diminish since the beginning of this year, based on the company’s numbers.

http://securitywatch.eweek.com/spam/spam_trends_down.html

Symantec to buy e-mail security vendor MessageLabs

Posted on October 8, 2008December 30, 2021 by admini

MessageLabs’ subscribers turn over the management of their e-mail and Web traffic security to the company and do not have to install on-site equipment.

The acquisition of MessageLabs gives Symantec an alternative e-mail security offering to BrightMail, the company’s antispam and antivirus appliance. “We think the opportunity to expand our footprint in the rapidly growing software-as-a-service market is significantly enhanced by this team becoming part of Symantec,” Symantec CEO John Thompson said in a conference call to discuss the deal.

MessageLabs’ service will be integrated into the Symantec Protection Network, an online-based backup, data-restoration and remote access service launched in April 2007 for small to midsize businesses. Adrian Chamberlain, CEO of MessageLabs, will lead the team and report to Enrique Salem, Symantec’s chief operating officer.

The company reported $145 million in revenue for fiscal year 2008, which ended July 31.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9116620&taxonomyId=17&intsrc=kc_top

Data Breaches Reach Record High

Posted on October 7, 2008December 30, 2021 by admini

According to the ITRC, subcontractor breaches, which affect multiple businesses, are listed as a single event.

As for the number of individuals affected by the breaches, it’s anyone’s guess.

Colleges and universities, on the other hand, are on pace to reduce breaches for the third consecutive year after accounting for 28 percent in 2006 and 24.8 percent in 2007.

Mobile data losses through laptops, thumbscrew drives and PDAs have accounted for the largest number of breaches both in 2008 (20.3 percent) and 2007 (27.8 percent).

http://www.eweek.com/c/a/Security/Data-Breaches-Reach-Record-High/?kc=WBGNLSTE10092008STR4

Malware in E-Mail Rose Dramatically in September, Security Pros Report

Posted on October 7, 2008December 30, 2021 by admini

“The malware for the fake iPhone games was named by the major anti-virus vendors as being associated with the Srizbi botnet.

Although Srizbi is still prevalent, it has been overtaken by the Cutwail/Rustock botnet as it relates to daily mail volumes.”

http://www.eweek.com/c/a/Security/Malware-in-Email-Rose-Dramatically-in-September-Security-Pros-Report/?kc=WBGNLSTE10092008STR3

New Protocols Secure Layer 2

Posted on October 5, 2008December 30, 2021 by admini

802.1AE is a completed standard and will be appearing soon in hardware.

Organizations have the option of encrypting frames that traverse the wire, but in theory, there are few reasons not to encrypt. We say “in theory” because of the potential performance impact encryption has on switch capacity and delay.

The default encryption algorithm, AES-GCM, will require a hardware upgrade in network infrastructure and host network interface cards. 802.1AE implementations must conform to performance characteristics defined in the standard.

The downside is that any products that transparently process network traffic, like load balancers, traffic shapers, and network analyzers, will be blind to 802.1AE-protected traffic.

802.1X-REV builds on 802.1X to support features like authentication of multiple devices on a single switch port and key distribution for 802.1AE devices. Rather than manually creating and installing keys in network devices, 802.1X-REV makes key management part of the protocol in a fashion similar to 802.11i or WPA/WPA2.

Many organizations’ physical wiring has one physical LAN port per desk or cubicle, and 802.1X on a wired network was originally designed to be deployed on a one-host-per-port basis. However, it’s now common for sites to have multiple hosts per port. For example, voice-over-IP phones have their own LAN port to plug into a desktop or laptop, which means two network devices per port. Recognizing this is a problem, switch vendors provide workarounds such as allowing one unauthenticated device to be placed on a specific virtual LAN, but a subsequent device has to authenticate before getting access to the network. Cisco allows its Cisco Discover Protocol to pass through an 802.1X port, which allows discovered devices to access a designated VLAN. Switches such as the HP ProCurve allow multiple hosts to authenticate, and the switch creates virtual ports based on a device’s MAC address and authentication state. If a workstation is connected to a VoIP phone and was properly authenticated, someone could simply clone the workstation’s MAC address and connect to the network through that VoIP phone.

If your company is in the planning stages of a switch upgrade, it might be a good idea to put off deploying the access layer until your chosen vendor supports 802.1AE and 802.1X-REV. Like all encryption technologies, 802.1AE will have an impact on network design.

Switches can send duplicate frames to a mirror port on a switch so that packet analyzers and intrusion-detection systems can process the frames, but that is not a perfect solution. For example, a full-duplex 1-Gbps link is capable of sending and receiving 1 Gbps simultaneously, for a total capacity of 2 Gbps.

http://www.informationweek.com/news/infrastructure/ethernet/showArticle.jhtml?articleID=210605169