Author: admini

Threat Landscape For The Future

Posted on by admini

Over the next year, we will see increased threat activity in the following areas: Phishing Phase II: a continued assault on personally identifiable information through web and application server manipulations; Attacks on the network infrastructure itself; Web services attacks; Mobile services exploits.

You think you are responding to a web query on a known server (the innocent fruit juice) when actually you have been redirected to a phishing site (the alcohol) by the good site. However, we have been warned so many times not to trust email that we apply much greater scepticism to it. As a result, the phishers are now applying more common hacker techniques such as HTTP request smuggling (HRS) or more common techniques such as DNS cache poisoning to cause site redirection by the trusted sites themselves. When we are on a compromised web server (i.e. the trusted site itself) we don’t have any way of easily verifying the fact that it has been compromised. In fact, this will be the major new form of phishing and I think we should be using a new term: The author proposes spyking.

The danger, as always, lies in the silent capture and exploitation of the consumer’s personally identifiable information and the loss of confidence in our e-commerce systems. This is a more dangerous threat in terms of the scale of destruction and we will continue to see its expansion.

Probably the biggest news in network security in 2005 was the exposing of the Cisco embedded web server flaw inside IOS. Every Cisco router running IOS 11.0 to 12.x was vulnerable. This also underlines the fact that 1) the embedded model of security in the network device is more dangerous than an overlay model and 2) that a monoculture (Cisco networking monopoly) is bad from a security standpoint. The enormity of the IOS flaw in terms of the number of devices affected is not to be underestimated and indeed can be viewed as a threat to national security since so many government sites use Cisco gear, too.

Thus, while not a new threat by definition, in fact the existence of unpatched systems well into next year will make it a vulnerability to watch.

With the advent of the web services revolution many vendors came out with security devices to safeguard the basic protocols of service oriented architectures (SOA). As web site developers roll out WAP enabled or 3G enabled sites, there is a strong likelihood that new vulnerabilities will be created because the technology is in its early stages of development.

http://www.it-observer.com/articles/1183/threat_landscape_future/

Read more

Network Access Heats Up With 802.1x Funk

Posted on by admini

Juniper’s latest release hits the market as its chief rival, Cisco Systems (Quote, Chart) ramps up its own technology and acquisitions in the increasingly competitive 802.1x and network access control space.
The 802.1x protocol is widely considered the standard in the nascent network access control market.

Both SteelBelt Radius and OAC were available prior to Juniper’s Funk acquisition but have been upgraded.

Earlier this month, Cisco helped itself to a new 802.1x supplicant with the acquisition of Meetinghouse Data Communications for $43.7 million, which is seen as filling out its NAC product lines.

“We know we want the standalone market and we’re going squarely after the endpoint integrity market,” Tavakoli said. “And if we ultimately lose some business because we’re not going to go out of our way to add proprietary features to Radius and Odyssey that basically support proprietary architectures by Cisco, so be it,” he said.

Cisco’s NAC and 802.1x efforts aren’t the only potential competition that Juniper faces in this space.

“We are confident in the feature gap between what will ship in Vista and what we have in Odyssey Access Client and that we will continue to be head and shoulders above.

http://www.internetnews.com/infra/article.php/3620336

Read more

EMC Deal Aimed at Securing Stored Data

Posted on by admini

EMC Corp.’s recent acquisition of RSA Inc. underscores the convergence of information security and storage. EMC, which sells large storage systems for use in corporate data centers, bought RSA—a manufacturer of encryption software and devices—to provide it with identity and access management technologies and encryption and key management software, which will help EMC deliver information lifecycle management. A survey last year by CompTIA, an IT trade association, found that protecting and securing data is the number one challenge in storage management.

A passel of widely-publicized cases of missing tapes containing Social Security numbers and other personal data has sensitized companies to the need for protecting information should it fall into the wrong hands. In addition, laws and regulations require banks and other financial institutions to institute policies for retaining, protecting, and accessing information.

“We’re now seeing the same blending of security and storage as we’ve seen with security and networks,” says Barbara Nelson, CEO of NeoScale Systems, which makes “appliances”–hardware devices that encrypt disks and tapes, and manage the keys needed to unlock data.

RSA’s encryption and key management technology is central to EMC’s strategy to directly protect information no matter where it resides within or outside of an organization, the company said in a statement.

While software encryption works at the application level, additional technology is needed to secure data at the media level, e.g., disks and tapes.

http://www.bankinfosecurity.com/articles.php?art_id=156&PHPSESSID=cfb4ec9e2060b1a75aa318ad04007258

Read more

IBM Releases Security Tool to Fight Off DOS Attacks, Worms

Posted on by admini

By integrating network, security, identity and systems management in a single, centralized interface, it enables organizations to respond immediately to security threats originating both outside and within the network.

“Current compliance initiatives, such as Sarbanes-Oxley, have moved security from being an esoteric practice to a boardroom-level initiative,” IBM Tivoli general manager for network management technology Lloyd Carney said in a statement.

http://www.darkreading.com/document.asp?doc_id=99138&WT.svl=cmpnews2_1

Read more

Symantec says enterprises failing to secure instant messaging

Posted on by admini

Despite the fact that instant messaging technology is nearly ubiquitous in the enterprise, and has been for some time, according to a new survey nearly 60% of organizations do not have any security technologies in place to defend against IM threats. Nearly all enterprises have developed email archiving, retention and inspection policies, but the survey results suggest few organizations have extended that to their IM systems. It starts with visibility. Most IT departments don’t have any visibility into the IM deployments in their enterprises,” said Andrew Burton, senior product manager at Symantec. Burton said IM security is an issue, but enterprises should also address IM usage policies, data leakage and risk management. “These three areas have been addressed in email security,” he said, “but most organizations haven’t viewed them as something they need to address with IM.”

Some industries, most notably financial services and securities trading, have developed regulations that specifically govern the usage of IM clients and require logging and archiving of IM conversations. Other industries are beginning to follow that lead, Burton said, but slowly, for the most part. “With regulatory compliance, life sciences and health care are starting to see the need for this. Government is coming on board, too,” he said. “In terms of governance, we’re seeing a broader movement across industries to secure IM in order to comply with audits and IT governance requirements.”

Burton attributed the increase to several factors, but noted that IM attacks often are more effective than email attacks, given the ease with which threats can spread through a user’s contact list.

“There’s a larger footprint [for IM] now, and the number of users attracts attackers,” he said. “Plus, the effectiveness is higher. Once someone is infected, the social engineering aspect of IM increasing the likelihood that other people will fall victim to the attack.”

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1199145,00.html

Read more

CSI survey: Data breaches still being swept under the rug

Posted on by admini

On the surface, the results of the 11th annual CSI/FBI Computer Crime and Security Survey are positive, with fewer companies reporting financial loss from data breaches compared to last year. But a majority of companies are still reluctant to report security breaches to law enforcement, suggesting that the survey isn’t capturing the full extent of the problem. Respondents tell us that they are keeping their cybercrime losses lower,” CSI Director Chris Keating said in a statement. “At the same time, our economic reliance on computers and technology is growing and criminal threats are growing more sophisticated, so we shouldn’t overestimate our strengths.”

About 25% of respondents said they reported computer intrusions to law enforcement, compared with 20% in the previous two years. But the percentage is still small, and CSI said a big reason for the drop in financial losses, as reflected in the overall survey results, is a decrease in the number of respondents able and willing to provide estimates.

“Even in an anonymous survey, only half of the 616 U.S companies surveyed were willing to share overall cost figures from financial losses resulting in security breaches. The impact of the Sarbanes-Oxley Act on information security remains substantial,” the report said.

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1199280,00.html

Read more