admini – Page 198 – CyberSecurity Institute

EMC Boosts Security Level of Network Analysis Software

Posted on December 13, 2006December 30, 2021 by admini

This new support gives users two layers of security, providing full encryption of packets as well as full encryption and authentication for polling and discovery.

With IP Tagging, users can better handle overlapping IP addresses in both IP and MPLS environments, company officials said.

“The EMC Smarts architecture allows us to integrate all of our siloed management systems, including in-house-developed systems, into one correlation console,” said John Premus, Chief Technology Officer JRI America in a statement.

“Of all the solutions tested, we found that only EMC Smarts software provides the levels of business logic necessary, without forcing us to write complex rules to capture every possible scenario,” Premus said.

Further upgrades include enriched support for key management environments like MPLS, and wider integration with system and application instrumentation solutions.

http://www.eweek.com/article2/0,1895,2072196,00.asp?kc=EWSTEEMNL121406EOAD

2007 To See More RFID Adoption, Continuing Need For Training

Posted on December 12, 2006December 30, 2021 by admini

Sommer said he doesn’t believe there is a “magic number” for calculating when the cost of RFID technology will be low enough to trigger widespread adoption. “We’ve seen where the tag itself, the semiconductor with the antenna, has gotten down to the 10- to 17-cent level,” he said during a recent interview, adding that the prices vary depending on how companies deploy the technology.

Eventually, when RFID is used in personal items such as clothing, retailers are likely to use technology that allows consumers to have the tags “killed” at checkout counters.

First, companies must train or hire people who have mastered the technology. “Few people understand how to tag goods to make sure they’re readable and how to configure readers in order to make sure they work,” Sommer said.

http://www.informationweek.com/news/showArticle.jhtml;jsessionid=GQ2KNKRGEDPBYQSNDLRSKHSCJUNN2JVN?articleID=196603236

Blurring the Line Between SOC & NOC

Posted on December 12, 2006December 30, 2021 by admini

The medical center’s intrusion prevention system (IPS), Web filtering tools, and other security and networking tools, for instance, are already converging, Khousnoudinov says. But that doesn’t mean the NOC and SOC will completely merge.

In fact, security analysts say you need a healthy separation between some duties, especially where security policy implementation and auditing is concerned.

Even Boston Medical, which is ahead of most organizations with its fusion of NOC and SOC duties, still keeps policy and auditing as well as its Windows Active Directory security separate from the overall NOC operation, according to Khousnoudinov. That prevents conflicts of interest or other related problems when, say, security must investigate internal access of the company’s resources, says Nicolett. “The security group in charge of investigations might [have to work on something] that involves privileged users,” he says.

The first place the NOC and SOC are converging is in event monitoring. “But control over what’s monitored and drilling down on this needs to be retained by the security staff,” Nicolett says. So start looking at your redundant call center or trouble-ticket systems, for instance, says Rob Enderle, principal analyst with the Enderle Group.

http://www.darkreading.com/document.asp?doc_id=112583&WT.svl=news1_2

Information Security Trends, Issues Continue to Evolve – FINSEC 2006 Conference, New York

Posted on December 9, 2006December 30, 2021 by admini

His descriptions of Key Indicators for the Financial Sector: What to Monitor and Log showed the approaches to logging and monitoring and noted that while regulatory rules mandate that banks regularly monitor event logging, it is growing more popular among institutional management as a way to protect not only the perimeter of the institution’s operations, but the data at rest too. Centralized monitoring offers institutions economies of scale through consolidated reporting, and correlation opportunities on an enterprise-wide effort.

Among other presenters was Karl Kasper, of JP Morgan Chase who spoke on “Security Architecture as a Foundation for Risk Analysis.”

Parker Foley of Wachovia spoke on Trends in Information Security Standards. Foley’s take on the drivers behind the trend toward higher-level models in policy structure and distributed models in management responsibility include the move to a business approach to security and the pressures of efficiency and cost reduction at larger banks.

Keynotes were presented by Thomas Dunbar, Global IT Chief Security Officer of XL Capital; Anish Bhimani, Managing Director of IT Risk Management for JP Morgan Chase Bank, and Ron Insana, Senior Analyst for CNBC. Dunbar’s keynote on Beyond the Expected: The Impact of Sarbanes-Oxley on Information Security Management, showed the direct link between a strong InfoSec department effectively dealing with Information Security as a business risk management issue and compliance with SOX.

Bhimani sees the evolution of information security into risk management as necessary to align with operational risk, regulatory compliance; and the partnership of information security with IT Audit in larger organizations will help make info security more visible.

http://www.bankinfosecurity.com/articles.php?art_id=172&PHPSESSID=1162cdc3d2eaefeb8ecf4017f0b2e046

Oracle Spurs Single Sign-On Surge

Posted on December 8, 2006December 30, 2021 by admini

The password reset problem is especially acute in environments like Oracle’s, where users may log onto half a dozen different apps, sometimes hosted on different servers and operating systems, on a given day.

The new Oracle suite is designed to help with that problem, according to Hasan Rizvi, vice president of security and identity management products at Oracle.

Oracle’s suite, which supports SAML, could be a stepping stone to more full-blown federated ID management environments that enable users to log onto many apps with the same password, analysts say.

http://www.darkreading.com/document.asp?doc_id=112382&WT.svl=news1_5

Ideas You Can Steal from Six Sigma

Posted on December 8, 2006December 30, 2021 by admini

With the blessing of top management, security looked at the entire supply chain and made some discoveries that were not apparent to individual managers.

Voice of the Customer (VOC) VOC is the process used to determine the needs of the customer, aimed at improving the customer experience and increasing loyalty. “Voice of the Customer forces you to leave the ivory tower and reach out and interface with your customers,” explains Greg Avesian, vice president of enterprise IT security at Textron. Following VOC’s directives to interface directly and frequently with the customer (Avesian meets formally with business unit CIOs every quarter, for example) ensures that security’s focus is on servicing the business units rather than guarding the bits and bytes, he says.

Failure Modes and Effects Analysis (FMEA) The FMEA procedure aims to identify every possible way in which a process or product might fail, rank on a scale of one to 10 those possible failures and probable causes, and prioritize solutions. “For security, the twist would be to say not just how could a given step fail, but how can we make it fail, how can we force it to fail?”

http://www.csoonline.com/read/120106/fea_six_sigma.html