admini – Page 229 – CyberSecurity Institute

Study: Sarbanes-Oxley forcing some companies to consider going private

Posted on June 16, 2006December 30, 2021 by admini

Many industry watchers expected audit fees would drop during public companies’ second year of complying with Sarbanes-Oxley Section 404, which requires companies to attest to the effectiveness of controls put in place to protect financial reporting systems and processes. Instead, they increased: Audit fees rose 22% for small companies, 6% for midsize companies and 4% for large companies (as defined by Standard & Poor’s indices).

Smaller public companies, in particular, felt the burden of increased audit costs, said Tom Hartman, corporate governance study director and business law partner at Foley & Lardner, in a teleconference. The fees companies pay their directors also have climbed considerably as a result of corporate governance and public disclosure reforms implemented since the enactment of Sarbanes-Oxley.

Overall annual director fees have increased an average of 71% for small companies, 64% for midsize companies, and 58% for large companies between 2001 and 2005.

When all the expenses are tallied, companies with under $1 billion in revenue spent an average of $2.9 million to comply with Sarbanes-Oxley in 2005, and companies with greater than $1 billion in revenue spent $11.5 million.

For companies of all sizes, audit fees represent the biggest portion of those expenses, followed by the cost of lost productivity.

For the first time in four years, not a single respondent said the reforms are not strict enough, Hartman said.

http://www.networkworld.com/news/2006/061506-sarbanes-oxley.html

SCADA industry debates flaw disclosure

Posted on June 16, 2006December 30, 2021 by admini

“These are what you would consider, in the IT world, critical enterprise applications,” Peterson said.

LiveData maintains that the flaw is a software bug, not a security vulnerability, pointing out that it only affects how the LiveData ICCP Server handles a non-secure implementation of the communications protocol–typically used only in environments not connected to a public network.

“In general SCADA networks are run as very private networks,” said Jeff Robbins, CEO of LiveData.

The incident has touched off a heated debate among a small collection of vulnerability researchers, critical infrastructure security experts and the typically staid real-time process control systems industry. The controversy mirrors the long-standing dispute between independent researchers and software vendors over disclosing vulnerabilities in enterprise and consumer applications.

Last week at the Process Control System Forum (PCSF), a conference on infrastructure management systems funded by the U.S. Department of Homeland Security, a similar debate played itself out. Perhaps three dozen industry representatives and security researchers met during a breakout session to hash out the issues involving disclosure. The tone became, at times, contentious, said Matt Franz, the moderator at conference panel on the topic and a SCADA security researcher with Digital Bond. “‘It puts people and infrastructure in danger,’ they said.”

Moreover, many vendors did not appreciate the involvement of the U.S. Computer Emergency Readiness Team (US-CERT), the nation’s response group tasked with managing the process of vulnerability remediation for critical infrastructure, Franz said.

The debate over how disclosure should be handled underscores both the intense focus on SCADA and DCS systems as potential targets of cyberattacks and the position of many companies in the real-time process control systems industry that vulnerabilities in such systems require special treatment.

For between 5 and 10 percent of the networks audited by PlantData, a single ping attack or a data flood aimed at a SCADA system could shut down most of the managed devices, Pollet said.

http://www.securityfocus.com/news/11396

Regulatory Compliance Planning Guide

Posted on June 16, 2006December 30, 2021 by admini

The regulations and standards come from many sources, such as national and local governments. Examples include the Sarbanes-Oxley Act (SOX) and the California Law on Notice of Security Breach, formerly known as SB-1386. They also come from industry-specific oversight groups, such as the Payment Card Industry Data Security Standards.

Not surprisingly, many companies find it difficult to understand how to respond appropriately to these regulatory requirements, and then maintain their regulatory compliance through cost-effective processes and procedures.

http://www.it-observer.com/articles/1161/regulatory_compliance_planning_guide/

Microsoft Reminds About Ending XP SP1 Support

Posted on June 15, 2006December 30, 2021 by admini

Customers running Windows XP SP1 must migrate to Windows XP SP2 over the next three months, or they’ll lose incident support as of Oct. 10. Microsoft also said it won’t release any more security updates for SP1 after that date. Microsoft reminded solution providers and end users Wednesday that support for Windows XP Service Pack 1 (SP1) will end Oct. 10.

During its monthly security briefing, Microsoft executives told customers to prepare their migrations over the summer. Microsoft said it’s open to signing Custom Support Agreements to extend support and hot fixes for Windows XP SP1 for eligible enterprise customers that have plans to migrate to Windows XP SP2.

Microsoft also reiterated that extended support for Windows 98, Windows 98 SE and Windows Millennium Edition (ME) will end July 11. Microsoft’s Software Update Service 1.0 reaches the end of its lifecycle on Dec. 6.

http://www.informationweek.com/windows/showArticle.jhtml?articleID=189401599

Money lost to cybercrime down–again

Posted on June 14, 2006December 30, 2021 by admini

“We’re seeing fewer of some of the attacks that have been such a plague for us in many years, and respondents are using less and less money.” Last year that percentage was 35 percent.

When it comes to cybercrime losses, consumers might be bearing the brunt of them, and they are not covered by the survey, Richardson suggested.

http://news.com.com/2100-7349_3-6083860.html?part=rss&tag=6083860&subj=news

Cerf: Wire Tapping VoIP Will Kill Innovation

Posted on June 14, 2006December 30, 2021 by admini

Last August, the FCC ruled CALEA also applied to Internet phone services and gave VoIP providers 18 months to comply with the order.

The ITAA report, co-authored by Vint Cerf, chief Internet evangelist of Google and Whitfield Diffie, chief security officer for Sun Microsystems, among others, notes that in some cases, VoIP calls are essentially the same as a traditional call.

http://www.internetnews.com/security/article.php/3613486