admini – Page 411 – CyberSecurity Institute

Security certification landscape: Vendor-neutral certs abound

Posted on November 18, 2003December 30, 2021 by admini

Most notably, we witnessed the introduction of a potential major player in the intermediate- to senior-level: ISACA’s Certified Information Security Manager (CISM) certification.

In this semi-annual update to SearchSecurity’s certification landscape series, we introduce you to the many vendor-neutral security certifications available, and we re-evaluate the importance of several older elements, as you’ll read in part two.

This landscape features more security certifications than ever listed before — a total of 56, counting each GIAC credential.

While this article focuses on vendor-neutral certs, you can learn what is available by specific vendors in our accompanying article in this series.
More info: [url=http://searchsecurity.techtarget.com/tip/1,289483,sid14_gci935445,00.html]http://searchsecurity.techtarget.com/tip/1,289483,sid14_gci935445,00.html[/url]

Report: Net attacks increasing

Posted on November 18, 2003December 30, 2021 by admini

The survey found that 725 new software flaws in the third quarter of this year, down slightly from 727 found in the second quarter.

However, the 823 new worms and viruses that appeared between July 1 and September represented a 26 percent increase from the previous three months.

“The window of time between vulnerability disclosure and the release of a working exploit continues to shrink, leaving enterprises with even less time to learn about and prevent attacks,” Chris Rouland, vice president of Internet Security Systems’ vulnerability research team, said in a prepared statement.

Security software maker Symantec also pointed to anecdotal evidence that the time was shrinking between the first public mention of details of a software flaw and the release of code exploiting the flaw.

Three serious Internet attacks–MSBlast, MSBlast.D and SoBig.F–struck in August.

The Computer Emergency Response Team (CERT) Coordination Center’s latest report indicates that the number of flaws that will appear in 2003 is likely to be smaller than in 2002.

That’s a first: Between 1999 and 2002, the number of vulnerabilities recorded by CERT roughly doubled every year.

More info: [url=http://news.com.com/2100-7349_3-5108921.html?tag=nefd_top]http://news.com.com/2100-7349_3-5108921.html?tag=nefd_top[/url] and
[url=http://bvlive01.iss.net/issEn/delivery/prdetail.jsp?oid=23118]http://bvlive01.iss.net/issEn/delivery/prdetail.jsp?oid=23118[/url]

Bill Gates Thinks Seamless And Secure

Posted on November 18, 2003December 30, 2021 by admini

The Microsoft chairman outlined for Comdex attendees the software needed to access and share information across a variety of devices, and said security continues to be a pressing issue.

Microsoft demonstrated for the first time a forthcoming tool for bolstering the security of business networks, the Internet Security and Acceleration Server 2004.

On the anti-spam front, Gates said Microsoft’s SmartScreen technology, already being used in the company’s MSN network, Hotmail service, and Outlook E-mail client, will be included “in the months ahead” in Exchange Server 2003.

More info: [url=http://www.informationweek.com/story/showArticle.jhtml?articleID=16100844]http://www.informationweek.com/story/showArticle.jhtml?articleID=16100844[/url]

Patching is a double-edged sword

Posted on November 18, 2003December 30, 2021 by admini

It also contradicts the way security is usually addressed. While there is much to recommend with regards to automating portions of the patch process, there are also compelling reasons to support manual intervention as a component of the work flow.

Too many have been burned by server farms going dark with a collective “blue screen of death” after applying a buggy service pack and are, quite reasonably, skittish about automatically slapping the latest patches on their production servers. Many release vulnerability warnings concurrently with the patch fixes, escalating the urgency of the patch cycle.
The result is that the industry is between a rock and a hard place on the patch issue.

Case in point: Six months before SQL Slammer hit companies such as Bank of America and Washington Mutual and brought portions of their automatic teller machine networks to their knees, Microsoft had released a vulnerability warning and a patch.

First and foremost, it means taking preventative measures that surround and support the patch management efforts. For patch management, services and tools that fit into the overall system and network management solution–not just that stay siloed in security–work more effectively.

Part of the reason the industry is in reactive mode so much of the time is that security is not seen as critical to the overall business profitability. Part of being proactive is knowing when something doesn’t need to get done and when a patch requires immediate attention. Sometimes reacting after the fact is essential, none of us are soothsayers, and even the most well protected and patched systems may ultimately be attacked.

So be ready with a plan for when that happens; the ability to recover from a critical failure is a part of the overall security posture. The truth is that patching and protecting proactively will reduce vulnerability, but being prepared for the inevitable reactive patching and recovery is essential as well.

More info: [url=http://news.com.com/2010-7355-5107678.html?tag=nefd_gutspro]http://news.com.com/2010-7355-5107678.html?tag=nefd_gutspro[/url]

Global 1000 Companies Should Hire a Chief Security Officer by the End of 2005

Posted on November 16, 2003December 30, 2021 by admini

The CEO’s primary responsibility is the strategy and direction of the business.
Security should be a concern but CEOs usually have a dozen other things in line ahead of it.

The paramount issue for the CFO is controlling costs. CFOs are not supporters of visions of robust, feature-rich and flexible architectures. Their reason is simple—they cost too much. The CSO must make the CFO understand that centralization of the security vision and spending will ultimately save money. The CSO must also initiate a Net Security Risk (NSR) exercise to calculate the financial risk of avoiding security spending.

The CIO keeps the business systems up and running. CIOs are already battling with the CFO for system budgets. In the wake of that battle, security is squeezed as a “nice to have.” For the CSO to succeed, the CIO must make it clear to the IT professionals that security is a part of all technology and a critical part of their jobs; failing to take this into consideration will lead to immediate termination.

The CTO establishes the technology direction of the company. The CTO, however, should not be in charge of the daily operational responsibilities of the business and should not be tasked with security operations among other technology decisions.

The COO is the battlefield commander responsible for the day-to-day operations of the company. Security adds an additional step to all other business and operational life cycles and thus requires more time, more people and more money, all of which are not central to the COO’s charter. Now there are personal privacy regulations in financial services and health care that make it a legal obligation to secure online information as well.

The CSO is responsible for physical and technology security. The CSO must then communicate this vision across all departments and business units.

More info: [url=http://techupdate.zdnet.com/techupdate/stories/main/global_1000_companies_should_hire_a_chief_security_officer_by_the_end_of_2005.html?tag=tu.fd.sc.link]http://techupdate.zdnet.com/techupdate/stories/main/global_1000_companies_should_hire_a_chief_security_officer_by_the_end_of_2005.html?tag=tu.fd.sc.link[/url]

Encryption Promises Unbreakable Codes

Posted on November 16, 2003December 30, 2021 by admini

This month, a small startup called MagiQ Technologies Inc. began selling what appears to be the first commercially available system that uses individual photons to transfer the numeric keys that are widely used to encode and read secret documents.

Photons, discrete particles of energy, are so sensitive that if anyone tries to spy on their travel from one point to another, their behavior will change, tipping off the sender and recipient and invalidating the stolen code.

“There are really no ways (of) cracking this code,” said Lov Grover, a quantum computing researcher at Bell Laboratories who is not involved with MagiQ.

Called Navajo – a nod to the American Indian code specialists of World War II – MagiQ’s system consists of 19-inch black boxes that generate and read the signals over a fiber-optic line.

MagiQ (pronounced “magic,” with the “Q” for “quantum”) expects that with a cost of $50,000 to $100,000, Navajo will appeal to banks, insurers, government agencies, pharmaceutical companies and other organizations that transmit sensitive information.

More info: [url=http://www.bayarea.com/mld/mercurynews/business/technology/7277751.htm]http://www.bayarea.com/mld/mercurynews/business/technology/7277751.htm[/url]