admini – Page 265 – CyberSecurity Institute

AirDefense Delivers AirDefense Personal 3.0

Posted on January 22, 2006December 30, 2021 by admini

While millions of mobile employees are greatly enhancing their productivity by using wireless devices to conduct business in and out of the office, along with the convenience of wireless connectivity comes an increase in security threats, including bridging, probing laptop, ad-hoc peer-to-peer network, phishing, evil twin, man-in-the-middle and other attacks.

AirDefense Personal’s flexible policy engine allows enterprises to centrally create, distribute and enforce policies such as allowing the use of specific VPNs, banning insecure applications on unencrypted networks, banned bandwidth hungry applications such as P2P and Video Streaming, Bluetooth, high-speed data cards (EV-DO, GPRS, EDGE and other 3G technologies) and certain hot spots.

With the AirDefense RF Boost feature, administrators can easily create custom policies and alarms to address company-specific needs, and these policies may be defined by groups, such as sales, engineering or finance, and by profiles and actions, such as telecommuters or administrators.

AirDefense Personal 3.0 also enables administrators to “black list” non-sanctioned networks, such as overlapping neighbor networks, as well as to track the location of all enterprise information assets. For example, AirDefense Personal allows administrators to determine in which city a mobile worker is connected, or where he or she was last connected or attacked.

Highly efficient and requiring little memory, AirDefense Personal is designed to work in conjunction with other client utilities, and because the system is centrally managed, administrators can install agents with no end-user involvement to effectively monitor activity and enforce policies throughout the organization. Further minimizing the impact on network administrators, AirDefense Personal provides a user-friendly interface that affords managers “quick glance” detection of event status and actions from the minimized tool bar.

http://www.ebcvg.com/articles.php?id=1045

Fear of fraud hampers UK online banking

Posted on January 22, 2006December 30, 2021 by admini

Five per cent of online bankers have no security software installed on their PC at all. The most common reasons cited include that it is too expensive, that they don’t need it or they don’t understand what it is.
Many banks’ terms and conditions reflect the voluntary Banking Code. The current edition, published March 2005, tells users to use up-to-date anti-virus and spyware software and a personal firewall.

But the FSA found that nearly all users (95 per cent) surveyed believe that at least some security responsibility should lie with the bank while 45 per cent believe banks should take sole responsibility.

According to APACS, the UK payment association, fraud losses through internet banking were £14.5m in the six months to June 2005. Although this is relatively low, losses have more than trebled since the same period in 2004 (£4m). The FSA’s research found that if banks were to tackle these losses by shifting the liability fully towards the consumer, more than three quarters (77 per cent) of users say they would abandon internet banking.

“Most consumers recognise they have some responsibility for security but they are not necessarily following this obligation through,” said Philip Robinson, Financial Crime Sector Leader at the FSA. “To tackle the losses associated with fraud, banks should continue to drive security and this must include educating consumers on the importance of protecting themselves. We recognise that many banks are already taking steps to engage consumers. Initiatives like the ‘Get Safe Online’ campaign between the Government and the private sector show consumer education is beginning to happen. But banks need to look carefully at consumer attitudes and whether their initiatives are effective in maintaining confidence,” he added.

http://www.theregister.co.uk/2006/01/23/online_banking_fraud_fears/

Symantec to Fortify its Compliance Software

Posted on January 20, 2006December 30, 2021 by admini

“Servers that have the host-based security agent on them are usually the most cooperative servers,” Pescatore said. “They’re the least the likely to go wrong. Where the security problems come from are rogue servers that pop up on the network that are not in the right configuration.” “So, if you’re only an agent-based solution, you’ll never see them. You’re only looking at what you’re controlling. That definitely fills a hole and they had to have it. ESM had hit that wall.”

ESM’s architecture was host-based, meaning it deployed agents, or software code that monitors, manages and reports on each machine’s status on a network. The software then checks the system information against assessment templates for government regulations like Sarbanes-Oxley and Health Insurance Portability and Accountability (HIPAA). Although these agents ensure that a computer has the latest patches and current user permissions, they also must be installed on every computer in the enterprise.

The company makes agent-less security management products based on credentialed access, considered ideal for automating security and policy compliance management on computers throughout an enterprise, regardless of where the machines operate. Symantec has said it will sell the BindView assets alongside ESM to give customers the choice of agent-based or agent-less security software, but analysts think the clock is ticking for architectures like ESM.

Many customers are clamoring for the credentialed access, he said, noting that agent-based solutions like ESM are both expensive and time-consuming because the agent has to be installed on every single thing on the network.

Mike Rothman, founder of new security research firm Security Incite, said that Symantec has to figure out what to do with ESM now that is has a more modern policy management software in place. “But again the mentality of buying BindView was to get that functionality but with an up-to-date and strategic architecture.” Rothman also noted Symantec isn’t the only company to make such a play, choosing to buy a company with market traction and a healthy install base to sink its teeth into the market.

http://www.internetnews.com/security/article.php/3579076

Hacker PC networks getting harder to find

Posted on January 20, 2006December 30, 2021 by admini

The first legitimate bot, called Eggdrop, was written in 1993 by Robey Pointer and had a feature that allowed more control over IRC networks. As legislation emerged cracking down on spammers, those who ran botnets started pursuing more clandestine ways to continue their operations. Rather than deter hardcore spammers, it merely drove them further underground, said Mark Sunner, chief technical officer for MessageLabs.

Increasingly, botnet administrators have customised IRC commands, and many well-known commands that allowed for the remote querying of machines have been disabled, Hogan said.

Over a year ago, two viruses – Netsky and Bagle – battled it out, uninstalling and replacing each other on users’ computers. Law enforcement authorities have become more adept at putting together task forces to track down botnet admins.

They have countered by sticking to smaller groups of around 20,000 machines that are less likely to be detected as quickly, Sunner said.

http://www.techworld.com/security/news/index.cfm?NewsID=5205

BANK SECRECY ACT Sharing Suspicious Activity Reports With Controlling Companies

Posted on January 20, 2006December 30, 2021 by admini

* A controlling company includes a bank or savings association holding company, or a company having the power directly or indirectly to direct the management or policies of an industrial loan company or a parent company, or to vote 25 percent or more of any class of voting shares of an industrial loan company or a parent company.

* Sharing a SAR within an organization is allowable for the head office, or for the controlling entity or party to discharge its oversight responsibilities with respect to enterprise-wide risk management and compliance with applicable laws and regulations.

* Accordingly, a bank or savings association (depository institution) may disclose a SAR to its controlling company(ies), whether domestic or foreign; and a U.S. branch or agency of a foreign bank may disclose a SAR to its head office outside the United States.

* Depository institutions, as part of their anti-money laundering program, must have written confidentiality agreements or arrangements, and proper internal controls in place to protect the confidentiality of the SAR.

http://www.bankinfosecurity.com/regulations.php?reg_id=140&PHPSESSID=dc6f96a8b3806f79be541fd18aa9c5a7

An Inside Look at IPSec in Vista

Posted on January 17, 2006December 30, 2021 by admini

One big change in Vista is in the TCP/IP networking stack itself. Vista has a totally revamped Next Generation TCP/IP stack that has a ton of enhancements with regard to performance, scalability, and extensibility. There’s also a new architecture called Windows Filtering Platform (WFP) that provides APIs for accessing packets at virtually any point in the path as they are processed by the stack. These changes to the stack affect how IPSec works because of the addition of built-in callout functions that can be used for IPSec communications.

A list of APIs for this feature can be found on MSDN if you’re a developer interesting in building IPSec-aware applications and tools. Note that these APIs, like any other feature of Vista, are subject to change before RTM.

Another change in Vista is that management of IPSec and Windows Firewall now are tied closely together. This is accomplished by integrating the firewall filtering functions and IPSec protection settings and managing them using a single snap-in called Windows Firewall with Advanced Security.

There are also unified command-line tools you can use as well to manage both Windows Firewall and IPSec settings. In fact, even the Group Policy settings for Windows Firewall and IPSec are now in the same place with Vista and are found under Computer ConfigurationWindows SettingsSecurity SettingsWindows Firewall with Advanced Security. That means in existing Windows XP and Windows Server 2003 platforms, it’s possible to set up firewall filters that conflict with IPSec policies and prevent network traffic from working the way you intend it to. With a single console for configuring both Windows Firewall and IPSec settings, there’s less chance for errors like this to occur, which is good since IPSec problems are notoriously difficult to troubleshoot.

Finally, the new console and command-line tools for managing Windows Firewall and IPSec settings are designed to make it a heck of a lot easier to configure IPSec policies in the first place.

The question is whether these enhancements on the client side will work with current Windows servers, or whether we’ll have to wait for Longhorn Server to see these benefits fully realized.

First, a Microsoft PressPass news release concerning the December 2005 Community Technology Preview (CTP) of Windows Vista says that the new integrated firewall/IPSec console “centralizes inbound and outbound traffic filtering along with IPSec server and domain isolation settings in the user interface.” And Vista is designed to help make domain isolation easier to implement–though Longhorn Server will probably be required for domain isolation to be truly simple to configure.

And second, Vista supports Network Access Protection (NAP), a new security technology that extends the Network Access Quarantine Control feature of Windows Server 2003 to help protect Active Directory-based networks from infected, misconfigured, or otherwise unhealthy client computers. Vista will change some of that, and Longhorn Server will bring this elusive goal even closer.

Meanwhile, the enhancements to TCP/IP and the IPSec management improvements found in Vista will make IPSec easier to use in the enterprise and likely lead to more organizations adopting it as an inside network protection technology.

http://www.windowsdevcenter.com/pub/a/windows/2006/01/17/an-inside-look-at-ipsec-in-vista.html