admini – Page 164 – CyberSecurity Institute

New IBM security services for mid-sized businesses

Posted on April 24, 2008December 30, 2021 by admini

Express Multi-Function Security Bundle — new services that help provide the most complete do-it-yourself protection against network threats, vulnerabilities, worms, viruses, spy-ware and spam in a single Unified Threat Management (UTM) solution.

IBM Express PCI Assessments – assessment for companies that accept, store or process credit card information for compliance with the Payment Card Industry (PCI) Data Security Standard. IBM developed these services in response to recent IBM X-Force research that showed an alarming rise in organized crime attacks on smaller organizations. According to IBM’s team of X-Force global security experts, because mid-sized companies typically lack the vast information technology (IT) resources needed to prepare for such attacks, they can often be prime targets for network attacks, data breaches and other malicious threats.

IBM Express PCI Assessments – assessment for companies that accept, store or process credit card information for compliance with the Payment Card Industry (PCI) Data Security Standard.

http://www.net-security.org/secworld.php?id=6057

Market’s Message to Security Pros: Adapt or Die

Posted on April 24, 2008December 30, 2021 by admini

“The security professional’s job is becoming less technical and more managerial… It means understanding the business needs and being able to speak to business people in terms they can understand.”

This year’s ISC(2)/Frost & Sullivan survey showed a marked increase in the number of security professionals who consider “communication skills” to be a critical part of their jobs. At the same time, however, fear of security breaches and the associated fallout has brought a new level of urgency — and tension — to the security pro’s day.

In a study published earlier this week by Amplitude Research and VanDyke Software, 50 percent of network administrators surveyed said that “securing remote access” was their chief concern, reflecting a growing concern about increasingly mobile employees.

“Growing awareness of the damage caused by security breaches, together with the increasing demand for a more mobile and remote workforce, will keep the worldwide market for security software buoyant,” said Gartner, which published its annual security software forecast earlier this week. Gartner predicts that the security market will continue to grow despite a poor economy, thanks in part to growing fear about breaches and the threat they pose to business.

Schmidt, who has been a top security officer at eBay, Microsoft, and the White House, said he was surprised at the concern displayed over potential damage to the corporate reputation, given that most of the companies which have publicly disclosed their breaches have suffered only temporary embarrassment. In fact, the question now is not how precarious the security manager’s job is, but what it may evolve into, Schmidt observed. “As it becomes more about risk, security is not necessarily an IT problem.”

http://www.darkreading.com/document.asp?doc_id=151738&f_src=darkreading_section_296

Cybercrime takes back seat to brand as CSO priority

Posted on April 23, 2008December 30, 2021 by admini

Howard Schmidt, a former White House security advisor, said the future of security lies in it being baked into systems, networks and processes. Schmidt added that consolidation in the sector was aiding that process with deals in the last couple of years, such as EMC buying RSA Security and Symantec combining with Veritas.

ISC2 board director Richard Nealon said security chiefs need increasingly to play a role in broader risk management, and applauded the role of regulations in mandating more secure regimes at organisations. “Until now, we’ve led a blessed life and our biggest threat was people who didn’t have a lot of malice, motivation, technology or education… They were script kiddies or enthusiasts, and most of the threats came from that vector.”

Now there is motivation and there is money to be made. They’ll produce a business plan, seek funding, allocate resources, and they basically do it for profit motives.

“Security used to be mainly technology then process, so you would have a technology control such as anti-virus or intrusion-detection, and a process such as patching and updating.”

ISC2 board director and consultant Peter Berlich said that although the profile of security is much greater than previously, the roles of chief security officers were still dependent on the nature of employers and industries.

http://www.cio.co.uk/news/index.cfm?RSS&ArticleID=2761

Microsoft: Vulnerabilities down, threats up

Posted on April 23, 2008December 30, 2021 by admini

The amount of malware removed from PCs by Microsoft’s Malicious Software Removal Tool (MSRT) jumped 40 percent during the last six months of 2007.

Microsoft’s semi-annual report uses data from various public sources as well as Microsoft’s Malicious Software Removal Tool (MSRT), Windows Defender, Windows Live OneCare, and Exchange Hosted Services.

At the RSA conference earlier this month, Microsoft called for an information-technology industry strategy to increase trust in the Internet. While Microsoft issued fewer bulletins and patched fewer flaws in 2007, the number of flaws in Microsoft Office jumped, though the company pointed out that most only seriously affected earlier versions of the program.

http://www.securityfocus.com/brief/727?ref=rss

NetWitness Integrates With Enterprise Consoles

Posted on April 23, 2008December 30, 2021 by admini

“In order to effectively ensure security, organizations often need forensic evidence and detailed analytics beyond those provided by the alerts of IDS, ADS, and SIEM products,” said Michael Montecillo, Analyst with Enterprise Management Associates.

“SIEMLink bridges the gap between high-level alerts and the information necessary to detect issues such as zero day attacks, designer malware and false positives.

http://www.darkreading.com/document.asp?doc_id=151709&f_src=darkreading_section_297

New Tool Lets Enterprises Manage Security on Multiple Linux Servers

Posted on April 22, 2008December 30, 2021 by admini

The good news about open source security tools is that they’re cheap and don’t require much administration.

The security tools available in the open source environment are easy to procure, but they don’t offer a central method of handling administration across multiple servers.

Trusted Computer Solutions Inc. tomorrow will attempt to jump into this void with the introduction of Security Blanket 2.0 Enterprise Edition, an automated “system lock down” and security management tool for Linux operating systems that can manage all local and remote Linux servers from a centralized Web-based management console. The idea is to make it easier for larger Linux environments, such as government and educational organizations, to do the “hardening” process required to meet security compliance requirements, says Jamie Adams, senior developer at TCS.

“It helps you figure out what needs to be configured, and then it helps you do the configuration.”

Currently, the primary open source tool for security administration is Bastille, but Bastille can’t configure multiple servers from a central location and doesn’t always meet current standards for compliance. The Enterprise version enables administrators to easily group Linux servers, associate a lockdown profile with a group of servers, scan all servers within a group to determine compliance, and configure the server operating systems to the lockdown level of the chosen profile.

Security Blanket 2.0 Enterprise includes the security guidelines recommended by the Center for Internet Security (CIS), the Defense Information Security Agency (DISA) Security Technical Implementation Guides (STIGs), and select guidelines from the SANS Institute’s defined risks associated with Linux.

Automation might increase organizations’ interest in server hardening, which many still don’t do, said Forrester Research in a report issued last year.

http://www.darkreading.com/document.asp?doc_id=151607&WT.svl=news2_1