admini – Page 212 – CyberSecurity Institute

Symantec Prepares For Shift To ‘Security 2.0’

Posted on September 20, 2006December 30, 2021 by admini

At the same time, Symantec wants to help businesses to be more careful about whom they let connect to their networks, the underlying principle of the emerging market for network-access control technology.

Yet as Symantec expands into new areas, and other high-profile vendors like Microsoft and Cisco expand their security offerings, the company could face unprecedented competition.

The company last week announced it’s teaming with Juniper Networks to build unified threat-management appliances, intrusion detection and prevention systems, and access-management and endpoint-compliance devices based on Juniper hardware and Symantec software.

“We need to understand all of the risks” that customers face, “although we don’t have to provide a Symantec-branded solution,” Bregman says. This sentiment was also evident in Symantec’s announcement Wednesday with Dell to help midsize businesses get control of their e-mail systems through a new offering called Secure Exchange.

http://www.informationweek.com/story/showArticle.jhtml?articleID=193004118&cid=RSSfeed_IWK_News

Thumb-sized leaks in corporate security

Posted on September 20, 2006December 30, 2021 by admini

“In many cases, it’s an unrecognized security problem,” says Jack Gold, founder of J. Gold Associates, an IT consulting firm. “Think about compliance issues if an insurance company employee downloads a couple of thousand customer records onto a flash drive and then loses the device,” he says.

While relatively few companies are addressing the issue, some have tried solutions ranging from total network lockdowns to requiring the use of encrypted flash drives to ensure that data will at least be safeguarded if it is lost. Although CHS has a “thou shalt not copy” policy regarding the downloading of sensitive information to portable memory devices, Valleau says he isn’t about to ban them, because “some people might need to carry protected medical records from one location of ours to another.” As a result, Valleau is looking at requiring employees to use only new, encrypted flash drives at the 1,000 computer workstations at the firm’s 210 offices around Florida.

Hospitals, which must closely guard patient information under the Health Insurance Portability and Accountability Act, are particularly concerned about flash drives.

Gower, vice president of information systems at Martin, Fletcher & Associates uses network-control software to limit both the type of content users can view and the time of day they can see it. Her company totally prohibits employees other than managers from copying data by limiting the network’s ability to write to portable storage devices. “The way we’ve got the network set up, employees can’t plug PDAs, smart phones, flash drives or USB hard drives into the network. “I have no doubt that, with all these portable memory devices in the workplace, there will be a federal privacy compliance breach in the next year.”

First line of defense: Establish a portable-device policy and educate users about it. Second line of defense: Network management tools, used by less than 5 percent of corporations, can restrict network access by individual, workstation or type of device. Third line of defense: Dismiss employees caught.

http://www.computerworld.com.au/index.php/id;1698947885;fp;16;fpid;0

Gartner: Security costs fall with good policies

Posted on September 18, 2006December 30, 2021 by admini

Rather than trying to anticipate a new regulation, it’s better for companies to treat regulation as one more factor in an overall risk portfolio, Heiser said.

From its latest data, Gartner expects information security budgets to increase 4.5 percent over the next year.

Wheatman said companies have shown success in negotiations with security vendors in getting, for example, antispyware included with antispam and antivirus software instead of paying extra. Antivirus software represented 54.3 percent of the revenue, at $4 billion.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9003402

Web flaws race ahead in 2006

Posted on September 15, 2006December 30, 2021 by admini

The case of Eric McCarty illustrates the danger: The network administrator found a database vulnerability in the online application site for the University of Southern California but was prosecuted for his unauthorized access of the server and last week agreed to plead guilty.

Easy-to-use Web programming languages are also to blame, because they attract people who have not programmed before and can be more easily audited for flaws, Christey said. “The existence of these web-friendly languages, like PHP, lowers the bar for someone to create a useful application but also lowers the bar for someone to find vulnerabilities in that application,” he said. In the CVE Project’s latest numbers, flaws that use a technique for injecting code from one Web site into another, known as cross-site scripting or XSS, accounted for 21.5 percent of the vulnerabilities reported so far in 2006.

http://www.securityfocus.com/news/11413?ref=rss

New IE hole revisits an old bug

Posted on September 14, 2006December 30, 2021 by admini

The xsec.org hackers referred to their code as a 0day, meaning an exploit for a previously undisclosed vulnerability. But one well-known hacker said the flaw was not difficult to find using publicly available security tools, such as the AxMan ActiveX fuzzing software.

Moore wrote an automated ActiveX testing tool called AxMan that uncovered a handful of IE bugs, including the one exploited by on xsec.org. Although Moore recently launched a project called the Month of Browser Bugs, in which he disclosed a new browser vulnerability every day for the month of July, he said he had refrained from disclosing this particular vulnerability. “This is one of the many exploitable bugs that can be discovered using AxMan and one of the few that I didn’t include in Month of Browser bugs due to the ease of exploitation,” he said.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9003329&source=NLT_AM&nlid=1

Putting Security in the Bank

Posted on September 13, 2006December 30, 2021 by admini

Bernik says his company is “trying” to routinely perform risk assessments on projects before they go live. “I’ve had challenges in my business getting business owners to listen and take heart” in implementing security controls.”

Banks are weighing the cost of strong authentication: Token-based authentication may make sense internally, but not for consumers, they say. “You’re not going to pay $30 to $40 for each of your millions of customers,” Axelrod said. Getting funding for security is not just a matter of folding it into projects from the get-go, but also making it a selling point for your customers, financial execs say.

http://www.darkreading.com/document.asp?doc_id=103706&WT.svl=news2_3