admini – Page 190 – CyberSecurity Institute

ID theft forecast: Gloomy today, worse tomorrow

Posted on March 7, 2007December 30, 2021 by admini

“Hackers are exploiting Internet auctions, money transfers like Western Union and PayPal, the ability to impersonate lottery and sweepstake contests, and other types of imaginative scams,” said Litan. “They’re going after the weakest links, the consumers using social engineering tactics, and the U.S.’s payment systems at retail and businesses.” “Banks eat the fraud there,” at least for now, said Litan.

A Massachusetts state lawmaker, however, has proposed a bill that would hold retailers financially responsible for breaches. “The retailers are already paying for fraud” in the form of higher interchange charges, Litan said. She offered up examples of how that might be done, including more sophisticated authentication on debit cards and payment processors relying on identity scoring systems that were able to spot thieves using indicators like physical location.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9012483&source=NLT_AM&nlid=1

Homeland Security plays real reasonable on Real ID

Posted on March 3, 2007December 30, 2021 by admini

At a press conference to set out the rules, DHS chief Michael Chertoff, played the Honest Joe card: “It’s very simple and it’s really a matter of common sense.

Applicants for driver’s licenses will need to bring documents to their state Department of Motor Vehicles offices to validate or prove five things: who they are, what their date of birth is, what their legal status is in the United States, their social security number and their address.

There are no solid plans to encrypt the barcode, meaning for example that bars might have access to patrons’ home addresses.

Inviting comment in its recommendations, the DHS said it “leans toward” scrambling the data, but said that cost might outweigh any privacy benefits. The history of such systems, such as the National DNA Database in the UK, suggest they are susceptible to mission creep; civil libertarians point out that once established, the only way for a database to go is bigger.

http://www.theregister.co.uk/2007/03/03/real_id_recommendations/

Microsoft Hit By U.S. DOT Ban On Windows Vista, Explorer 7, and Office 2007

Posted on March 3, 2007December 30, 2021 by admini

In a memo to his staff, the DOT’s CIO Daniel Mintz says he has placed “an indefinite moratorium” on the upgrades as “there appears to be no compelling technical or business case for upgrading to these new Microsoft software products.

Among the concerns cited by Mintz are compatibility with software applications currently in use at the department, the cost of an upgrade, and DOT’s move to a new headquarters in Washington later this year.

“Microsoft Vista, Office 2007, and Internet Explorer [7] may be acquired for testing purposes only, though only on approval by the DOT chief information officer,” Mintz writes.

In an interview Friday, DOT chief technology officer Tim Schmidt confirmed that the ban is still in effect. The DOT’s ban on Vista, Internet Explorer 7, and Office 2007 applies to 15,000 computer users at DOT proper who are currently running the Windows XP Professional operating system.

The memo indicates that a similar ban is in effect at the Federal Aviation Administration, which has 45,000 desktop users.

http://www.informationweek.com/news/showArticle.jhtml?articleID=197700789

Japanese police confirms cybercrime growth trend

Posted on February 22, 2007December 30, 2021 by admini

The majority of cybercriminals in Japan were in their teens and twenties, following the trend from recent years.

The NPA is currently trying to promote public awareness of cybercrime and has so far succeeded in that, which has been highlighted by a significant drop in the number of cybercrime complaints for the first six months of 2006.

http://www.viruslist.com/en/news?id=208274044

Cisco’s Web Security Play

Posted on February 22, 2007December 30, 2021 by admini

“Identity management is one aspect of security that becomes a lot more complex in a Web services environment, because now you need a way to preserve the identities of both users and applications across different services.

The merger of Cisco and Reactivity could make it easier for enterprises to build a common structure for Web services security in at the network level, rather than forcing application developers to resolve the security issues at the program level, experts say. From that standpoint, especially in the virtualized data center, Reactivity and Cisco are in a good spot to make things happen.” “There is a threat of external attacks, and we’re addressing that, but in Web services, there’s a more important threat, which are security problems caused inadvertently by misprogramming,” says Sirota.

http://www.darkreading.com/document.asp?doc_id=117912&WT.svl=news1_2

VMs Create Potential Risks

Posted on February 21, 2007December 30, 2021 by admini

“But one of the key things about hypervisors is their design is simpler than the modern operating system. On the flip side, it’s a new layer that’s another opportunity for attack,” he says.

Hypervisors are programs that allow multiple operating systems to use the same hardware. But these programs can also breed complexity, and with complexity comes security problems.

Virtualization security solutions so far have been focused mostly on the hypervisor: IBM, for instance, recently unveiled SHype, a new secure hypervisor technology that ties security policies to virtual machines. And VMWare’s desktop Ace software lets you lock down virtual machines, even when they are moved around. Lin says it works like a network access control (NAC) for virtual machines.

Thomas Ptacek, a security researcher with Matasano Security, says the move to virtualization is the biggest thing happening in IT today. “Some say virtualization of the OS doesn’t change anything, and others, that with virtualization, everything is broken,” Sequeira says. There are more vulnerabilities in your operating system than in your virtualization software, such as VMware, Matasano’s Ptacek notes. It’s more about how you configure your virtual architecture, where the virtual machine software is the main barrier among the different apps sharing the same physical machine.”

The underlying problem: Virtualization creates a set of dynamics in the IT infrastructure that traditional security approaches “don’t cope with well,” says Kevin Leahy, director of virtualization at IBM.

http://www.darkreading.com/document.asp?doc_id=117908&WT.svl=news2_3