Author: admini

RSA sees looming identity crisis online

Posted on by admini

“You’re talking about hundreds of thousands of people who need to be authenticated,” Andrew Nash said at the RSA Conference in Barcelona. “If we can’t adopt quickly enough, the Internet will become known as a very unsafe place. People won’t have confidence in it and (companies) will bail out, if not put their technology on hold.”

Nash said identity fraud, such as through phishing scams, was partly to blame, and that it was difficult to moderate online identities. How do you know who the end users are? Without having the guarantee of identities, there is a big block to having more e-commerce.”

Phishing, in which fraudsters fake their identity to lure victims into submitting their personal details, has played a large part in identity theft. Customers of many major banks and e-commerce sites, such as eBay, have been the targets of such scams.

Nash said the Liberty Alliance, a user-based security group with members such as AOL, MasterCard and American Express, was trying to push for an identity federation through which companies could share authentication methods, but retain a certain amount of authority.

RSA Security, an electronic security firm in Bedford, Mass., is an active member in the Alliance, and the company said that there were around 30 other organizations trying to solve identity problems on the Internet.

Nash added that organized crime gangs were already targeting businesses to build an e-crime network that fed on e-commerce. “I was at a demonstration recently where there was a lot of interest in Internet monitoring on behalf of law enforcement,” he said. “(It) showed there was a serious amount of organized criminals moving toward specific targets. They were building a system to defragment vendors and business in coordinated attacks.”

http://news.com.com/RSA+sees+looming+identity+crisis+online/2100-7348_3-5440974.html?part=rss&tag=5440974&subj=news.7348.5

Read more

Greatest security risk: Social engineering, says Gartner

Posted on by admini

Gartner defines social engineering as “the manipulation of people, rather than machines, to successfully breach the security systems of an enterprise or a consumer”. This involves criminals persuading a user to click on a link or open an attachment that they probably know they shouldn’t.

Rich Mogull, research director for information security and risk at Gartner, said social engineering is more of a problem than hacking. “People, by nature, are unpredictable and susceptible to manipulation and persuasion. Studies show that humans have certain behavioural tendencies that can be exploited with careful manipulation.” “Many of the most-damaging security penetrations are, and will continue to be, due to social engineering, not electronic hacking or cracking,” said Mogull.

According to Mogull, identity theft is a major concern because more criminals are “reinventing old scams” using new technology. “Criminals are using social engineering to take the identity of someone either for profit, or to gather further information on an enterprise. This is not only a violation of the business, but of someone’s personal privacy,” said Mogull.

Rob Forsyth, managing director at Sophos in Australia and New Zealand, told ZDNet Australia about a ‘malicious and cynical’ scam that recently targeted unemployed Australians. According to Forsyth, the potential victim received an email that purported to come from Credit Suisse bank advertising a job opportunity. The email asked the recipient to go to a Web site that was an almost exact replica of the actual Credit Suisse site — but this version contained an application form for the ‘vacancy’. Forsyth said the replicated Web site was recreated so thoroughly that it took experts ‘some time’ to confirm that it was actually fake. It took us some time to determine it was a fake site. It was not necessarily groundbreaking but quite a clever combination of technology.

“They are targeting those people in the community that are most in need — those seeking work. It is exactly those people that might be vulnerable to this kind of overture,” said Forsyth.

http://news.zdnet.co.uk/internet/security/0,39020375,39172157,00.htm

Read more

Vendors promise solid tech support, but our test found long hold times and poor advice

Posted on by admini

Robust, exciting technology may be the spark that brings vendors and customers together, but support is the stuff of long, happy relationships. With a malware storm always on the horizon, you’d expect AV vendors to have among the best customer support programs.

The last thing you’d expect is having to wait an eternity on an 800-number listening to Burt Bacharach melodies only to tell your problem to a call center operator with a checklist of questions and stock responses.

But that’s exactly what Information Security found disturbingly often in our review of leading AV vendors’ customer support.

Information Security graded each on the entire support experience, putting the greatest weight on the ability to solve our test problems (see “Report Card”).

http://infosecuritymag.techtarget.com/ss/0,295796,sid6_iss486_art1005,00.html

Read more

Companies under security pressure

Posted on by admini

Failure to patch and update systems effectively after the identification of known threats is the single largest operational risk UK-based companies with operations overseas and more than 5,000 employees.

A third of the sample of 40 senior UK-based IT security personnel said it took more than six hours to contain a new threat across their organization.

A quarter (25 per cent) saw Distributed Denial of Service (DDOS) attacks as the single largest risk to their business, whilst laptop and Personal Digital Assistants (PDA) theft was the key concern for 8.3 per cent of respondents.

Application-level threats are by far the most significant emerging threat for large companies this year, with 58 per cent of the sample stating that attacks against enterprise apps gave them the fear.

The Sarbanes-Oxley Act is seen as having the most impact on enterprises’ information security management planning in 2004 with 36 per cent of the sample giving this a top rating.

BS7799-2:2002, the government’s gold standard for information security, came in third with just 19 per cent even though it was rated as the best framework for defining companies’ Information Security Management Systems by the security pros quizzed by NetSec.

David Howorth, sales director of NetSec UK Limited, commented: “The findings illustrate that large enterprises already recognise that they are buckling under the strain of the workload created by new vulnerabilities and threats.

http://www.xatrix.org/article3680.html

Read more

Symantec – driving security deep into an enterprise

Posted on by admini

Symantec’s view is that a company’s business information is its most strategic asset and must be protected at all times.

This is not something that will be new to any business executive, especially given the number of legal and industry regulations, such as data protection and privacy, Sarbanes-Oxley and regulations regarding food safety that affect a wide variety of businesses.

This has upped the ante in the need to protect information from being altered in any way – or protecting the integrity of that information.

In order to be able to assure the integrity of business information, companies need to have the availability to scan all of the computational assets that they have in their networks to gauge the risk of vulnerabilities, security exposures and threats. This allows organisations to understand the resources that they have in place so that risk posed by security exploits that threaten the availability of those systems can be assessed.

Once the risk assessment exercise has been performed, organisations are in a better position to address those threats and can prioritise the actions that they are going to take to remediate against those vulnerabilities based on the value of the information to a company. Once a company is in the position to act on real-time security information, it is better placed to deal with incidents and disasters when they happen, and safeguard against threats in the future by establishing the policies, procedures and control mechanisms that are required for safeguarding information systems.

Using Symantec’s capabilities for monitoring and managing threats, along with real-time business reporting and analysis, companies are better able to ensure that information integrity is being achieved – taking them one step nearer to legal and industry compliance.

In line with its new corporate positioning initiative, Symantec has just announced the availability of some new products. These include the latest version of its Gateway Security Manager appliance, which provides network security capabilities including firewall, intrusion detection and prevention, antivirus policy enforcement, content filtering and virtual private network technology. This latest version extends gateway security capabilities to include mobile networks with the inclusion of a secure wireless LAN access point, making it suitable for use in remote and branch office environments as well as within the four walls of the corporate office.

Even with effective network security products, disaster can still occur, and information integrity can only be achieved if companies can recover from a catastrophic disaster affecting their networks. For this, Symantec has developed its LiveState Recovery family of products which allow full system restoration or recovery of any files on a server or desktop to ensure that information is available when needed – and hence reducing downtime to a business.

Finally, Symantec has brought out the latest version of its Enterprise Security Manager, which provides functionality for reporting on compliance with regulations, including pre-configured assessment templates designed for specific regulations, such as Sarbanes-Oxley and Gramm-Leach-Bliley.

http://www.it-director.com/article.php?articleid=12354

Read more

Biometrics early adopters reveal secrets, challenges

Posted on by admini

Gathered at the Millennium Hilton across the street from the site, attendees of the Fall 2004 Biometrics Summit heard about the challenges and benefits seen by those who would implement biometrics, both before and after the 9/11 attacks that put a greater focus on security needs.

Acknowledging that most of the 9/11 attackers used driver’s licenses to board the airplanes they would use as weapons, one presenter said biometrics should be a key tool, in conjunction with better verification of identity-proving documents, in the process of obtaining driver’s licenses.

Illinois was the first to use facial recognition technology in its DMVs, four years before 9/11, and the state is currently preparing an upgrade to its systems, said Beth Langen, administrator of the policy and programs division of the Driver Services Department in the Illinois Office of the Secretary of State. The measures have helped combat fraud, catching those who try to get multiple licenses for different identities. In all, 1,700 cases of fraud have been discovered using the facial recognition software, with 173 people claiming three or more identities.

Originally, the department had considered using fingerprint readers, but went with facial recognition for several reasons. It now contains 16 million pictures, and it is growing by 8,000 to 12,000 every day. The department had used a sign-up sheet before that, but employees who didn’t want anyone to know they came in late started ripping out pages, said Malachy Higgins, chief of administration. The office tried using card readers, but found that administering the cards was a big headache, and if they were going to be late, employees could give cards to others who went in earlier to make it appear that they were on time.

Scott Sykes, group managers of strategic technology at Capital One, encountered a lot of resistance to his ideas for bringing biometrics technology into the financial services firm. The fundamental point of resistance was whether the reduced risk, cost savings and increased efficiency outweigh the expense required, Sykes said. Biometrics readers aren’t built into laptop or desktop computers, making the readers a hassle to add into a network.

Until these hurdles are overcome, biometrics will have a hard time getting a foothold in most enterprise companies, Sykes said.

http://www.nwfusion.com/news/2004/1028biometrics.html

Read more