admini – Page 202 – CyberSecurity Institute

Phishing is becoming a higher value illegal activity for hackers

Posted on November 9, 2006December 30, 2021 by admini

According to Gartner analyst Avivah Litan, this is happening because scammers are identifying higher-income targets, moving their phishing sites more frequently and switching up the types of business they try to impersonate.

Victims click on links they receive in the body of e-mails — and, increasingly, in instant messages — from sites purporting to be legitimate businesses like financial institutions, e-commerce and auction sites.

Approximately 109 million U.S. adults have received phishing e-mail attacks, up from 57 million in 2004, according to Gartner. Total loses from phishing attacks have risen to $2.8 billion in 2006, twice the amount lost in 2004.

According to the survey, conducted by Gartner analysts in August of this year, adults earning more than $100,000 per year are attacked more often than those making less.

According to Litan, cyber criminals have done a better job of identifying high-income individuals. They sell each other credit card numbers in online chat rooms, and can identify credit cards with higher spending limits by the first six digits on the card.

http://www.internetnews.com/stats/article.php/3642971

Defending the data will be a focus for 2007

Posted on November 8, 2006December 30, 2021 by admini

Most of the “blocking and tackling” that was needed to handle network threats has, to a large extent, already been accomplished via technologies such as firewalls and intrusion-detection and -prevention systems, said Mark Burnett, director of IT security and compliance at Gaylord Entertainment Co. in Nashville. “We are layering technology controls to make sure we can identify where the information is passing across our network” and protect it. The overall driving force behind our [security] program is reputation management. Any one incident could ruin all that work.”

Also driving the focus are regulations that Gaylord is required to comply with, such as the Sarbanes-Oxley Act and the Payment Card Industry (PCI) data security standard, which is mandated by the major credit card companies, he said. Ann Garrett, the chief information security officer at the North Carolina state office of information technology in Raleigh, said that a new state law governing the use of personally identifiable information has elevated the need for security controls at the data level.

High-profile breaches such as the one at the Department of Veterans Affairs earlier this year have resulted in an intense scrutiny of data security practices government-wide said Patrick Howard, chief information security officer, at the U.S. Department of Housing and Urban Development.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9004914

81% of IT Managers report a security incident due to IM or other Greynets

Posted on November 8, 2006December 30, 2021 by admini

Results of the survey show that more users are adopting greynet applications while, at the same time, little progress has been made toward combating greynet-related attacks. Greynets – real-time communications applications that are often introduced by end users and use highly evasive techniques to traverse the network – pose myriad network and information security risks because they provide vectors for malware, intellectual property loss, identity theft and compliance risks.

A typical organization is estimated to spend nearly $130,000 per year on average to repair damage from greynet-related attacks, while the largest companies are estimated to spend upwards of $350,000 per year repairing damage from greynet-related attacks due to higher incident rates.

http://www.it-observer.com/news/6950/81_it_managers_report_security_incident_due_im_or_other_greynets/

Microsoft trains partners to improve security

Posted on November 8, 2006December 30, 2021 by admini

Microsoft adopted the Security Development Lifecycle as part of its Trustworthy Computing Initiative, adopted in January 2002 after the massive Code Red and Nimda worm epidemics. The SDL aims to drum out security flaws from the company products and train development, quality-control and support staff to keep flaws from reoccurring. Windows 2003, Visual Studio 2005, Internet Explorer 7 and Microsoft Office 2007 have all been developed under the SDL process.

http://www.securityfocus.com/brief/351

Managed Services on the Rise

Posted on November 8, 2006December 30, 2021 by admini

The most recent movement comes from BT Group, global provider of communications solutions and managed services, which announced that it acquired Counterpane Internet Security, a provider of managed network security services.

In late September 2006, SecureWorks and LURHQ merged under the SecureWorks name.

In late August, IBM announced that it had reached a deal to acquire Internet Security Systems (ISS) for $1.3 billion in cash.

If Perimeter wants to be acquired, its own recent acquisitions make it ripe for that possibility. SurfControl announced two new managed security services offerings for Web and email protection. The merger and acquisition trends fit with industry analyst projections for increasing interest in the overall managed services sector.

http://www.windowsitpro.com/WindowsSecurity/Article/ArticleID/94176/WindowsSecurity_94176.html

Security must focus on desktop policy

Posted on November 7, 2006December 30, 2021 by admini

Outside the control of an organisation, such applications can increase the risk of the company network being hit with malicious software, designed to steal data, or worms and viruses that can paralyse company systems.

The influence of major events on the downloading of personal email files to company PCs was also reflected in the amount of respondents -34% – who had opened attachments during this year’s World Cup. The research also highlights a number of areas where unintentionally users could be increasing security risks; 28% of the employees share files with family and friends and 25% allowed others to go online using their work computer, effectively forfeiting control over what is being used on or downloaded to their devices. Just under half said that they connect devices to their computers such as cameras, music players, mobile phone and PDA.

The research also indicates that most users are probably unaware of the risk posed by their behaviour with 90% of those surveyed believing that their work computer is either fairly or very secure, with 67% trusting that their IT department has taken the necessary measures to secure their device against threats.

http://www.it-observer.com/news/6945/security_must_focus_desktop_policy/