Security News Curated from across the world
McAfee, Inc., the global leader in Intrusion Prevention and Security Risk Management, today announced a significant milestone in the growth of malicious threats faced by businesses and individual users. McAfee Avert Labs combine world-class malicious code and anti-virus research with intrusion prevention and vulnerability research expertise.
http://interestalert.com/story/siteia.shtml?Story=st/sn/0706001caaa04683.prn&Sys=siteia&Fid=COMPUELE&Type=News&Filter=ComputerandElectronics
“These survey results demonstrate that even though organisations are investing in security technologies, they still aren’t achieving the results they seek,” said Toby Weiss, senior vice president and general manager of CA’s Security Management Business Unit. “Clearly, more work needs to be done in terms of improved security management itself and better education of business users about the importance of IT security best practices.”
The survey also found that organisations are turning to identity and access management technologies to improve security, enable regulatory compliance and reduce costs. More than 75 per cent of the organisations surveyed have implemented some form of identity and access management functionality, and are continuing with investments. An additional 18 per cent plan to begin rolling out an identity and access management solution or extend their deployments over the next 12 to 18 months.
http://www.crn.com.au/story.aspx?CIID=39872&src=site-marq
When integrated with Cisco’s existing security portfolio, Meetinghouse’s AEGIS SecureConnect products will enable Cisco to provide a single unified wired and wireless client to enterprise customers that will help them reduce operational costs by simplifying the security management of a broad array of host devices and operating systems.
“The Meetinghouse software supplicant is a natural extension to existing Cisco initiatives such as the Cisco Self Defending Network via Network Admission Control (NAC) and the Cisco Compatible Extensions (CCX) program.”
http://www.darkreading.com/document.asp?doc_id=98654&WT.svl=wire_1
“Each NAC product works a little differently, but in every case, we found the means to bypass it,” says Ofir Arkin, CTO and co-founder of Insightix. For example, most NAC technology assumes that users will be granted access to the network via Dynamic Host Control Protocol (DHCP), which keeps IP addresses in a pool and hands them out as each user is authenticated. Through DHCP, NAC systems can restrict user access and recognize unauthorized attempts to gain entry to sensitive information. However, an insider with access to the corporate network often has the option to configure his PC with a static IP address, Arkin observes.
“That means if you can find the address of the router, which is contained in TCP/IP settings on most PCs, you can link directly to the router and enter the network undetected,” Arkin says.
NAC systems are also at risk because they normally work entirely through IP addresses, without collecting information on where devices are located or how they are connected to the network, Arkin states. NAC systems generally cannot detect activity between nodes on the same subnet, particularly if the client avoids broadcast transmissions.
Users could also gain access through unauthorized devices or old, forgotten systems and connections that don’t show up in a standard DHCP address discovery.
http://www.darkreading.com/document.asp?doc_id=98626&WT.svl=news1_2
The pesky thing about WiFi security is that it also extends beyond the confines of the enterprise network, as Gartner notes. “Managing wireless security also involves managing users and devices when they are connected from remote branch offices, hot spots, and home offices,” says analyst Rachna Ahlawat.
http://www.darkreading.com/document.asp?doc_id=98497&WT.svl=news2_5
Chairman David Goodman declared on day one that the role of identity-related trust – at both a personal and corporate level – was dramatically changing Internet-based transactions.
In the first keynote address, Stijn Bijnens, SVP of Identity Management at Cybertrust, stated that the main drivers of identity are security, integration of physical and logical access control, flexibility, productivity, compliance and customer satisfaction. On the drivers behind national identity programmes, Bijnens also recognised the need for more efficient e-government, both regionally and across-borders, as well as new applications such as e-tickets on public transport and physical access to public buildings.
During the morning’s panel debate, Chief Security Officer at Corestreet, Bob Dulude, echoed Bijnens’ sentiments, claiming that e-ID cards must be technically interoperable to support multiple applications, with the caveat that security and privacy could be more easily compromised when there is a vast amount of data on a single smartcard. “It united senior IT, marketing and management personnel from some of the biggest players in the industry to share their valued opinions.”
http://www.it-observer.com/news/6564/identity_become_key_technology_focus/