Category: News

Amit Yoran, CEO of security firm NetWitness and the former director of the National Cyber Security Directorate at the DHS, criticized today’s risk management practices.

The security industry is awash in bad data, and companies that attempt to use the metrics could take the wrong actions, he said.
The process requires that executives work with their security group to find the right way to measure security for that specific company, he said.
“Set the expectations that a lack of due care is not going to be tolerated.”

http://www.securityfocus.com/brief/926?ref=rss

Becoming part of the network is required under the Convention on Cybercrime, an international treaty that sets a legal model for other countries to follow when writing anticybercrime legislation.

Of 47 countries that are part of the Council of Europe, 24 have ratified the treaty, and 23 others have signed it but are awaiting their national legislatures to ratify it.

The 24/7 Network is intended to improve coordination between law enforcement, as Internet scams and frauds are often executed using networks of hacked computers located around the world. That poses much difficulty for law enforcement, as potential evidence could be quickly erased or lost, making prosecutions difficult.

On Wednesday, law enforcement, government officials and security professionals held a closed-door meeting at the International Conference on Cybercrime in Strasbourg, France, to discuss its status.

http://tech.yahoo.com/news/pcworld/20090312/tc_pcworld/worldwidecybercrimepolicenetworkgrows

Cyberattack maps developed by Sandia researchers were presented to the public during a seminar last week at Harvard University. Those measurements make up a complex computer simulation of a massive botnet attack against a large-scale network.

Goldsmith presented the Sandia research as part of the “Cyber Internal Relations” series sponsored by MIT and the Belfer Center for Science and International Affairs at the Harvard Kennedy School. The researchers chose to examine a root attack, a Byzantine attempt to gain control of a target system at its most basic level of operation.

Applications of such simulations aren’t academic at all; such large-scale IT infrastructures would of course include those of state and federal agencies or defense contractors. Goldsmith and other attendees at the lecture assert that the “Holy Grail” of cyberwarfare is to quickly and accurately map out the network of an attacker or defender. Such a map could produce a decisive advantage, just as understanding the local geography of a country is a crucial advantage in real-world warfare.

Goldsmith is the lead scientist on a project creating intelligent white hat software agents that enable networks to be self defending.

Enterprise intrusion detection software in the future may include network topography and intelligent agents in a collective to improve its effectiveness. The developers of high-level enterprise architecture policies, including service-oriented architectures, will need to consider where and how to build in a level of autonomous intelligence into networks.

In an address Feb. 26 at an Armed Forces Communications and Electronics Association meeting in Baghdad, Sorenson called for greater information sharing on a single communications network.

http://gcn.com/Articles/2009/03/10/Cyberattack-mapping.aspx

But Brocade also recognises that encryption by itself is not enough. “Of course encryption is one of many security options, but reports from Gartner and others have suggested that encryption is the biggest issue,” said Murphy. “We believe that the combination of the removal of the performance hit, and the removal of disruptive hit, will make it easier for businesses to choose, especially for companies having to comply with new rules…We are seeing more and more opportunities at the moment.”

Murphy also feels that another reason why companies have been hesitant going down the encryption road is in balancing the risk, in that there is no tangible ROI to show the Financial Director when deploying encryption as it is often compared to having an insurance policy (you only realise ROI when you claim). “It is almost like an inverted equation,” Murphy said. “So it has been a tough sell for the IT manager.”

97 percent of respondents considered their data to be very secure or secure.

http://www.techworld.com/news/index.cfm?newsid=109511&pagtype=all

Security vendors from Imperva to Guardium are increasingly tying security information management to database activity monitoring. The latest example of this trend is NitroSecurity. More and more vendors are tying together database activity monitoring and security information management, a move that could benefit enterprise data protection efforts. Late last year, Imperva and ArcSight announced interoperability between their products. Earlier in 2008, Guardium announced integration with a number of security information management (SIM) vendors, including ArcSight, CA and LogLogic. Six months after purchasing RippleTech for its database activity monitoring (DAM) and log management tools, NitroSecurity announced today it has fully integrated its NitroView DBM and NitroView ESM products.

From a management perspective, combining SIM – or SIEM, security information event management – and DAM centralizes monitoring and policy implementation.

“The example of a pooled application comes to mind, where an application is accessing a database, but multiple users are logging into the application,” said Frank Hayes, vice president of marketing at NitroSecurity.

http://www.eweek.com/c/a/Security/Vendors-Tie-Database-Activity-Monitoring-to-Security-Event-Management/

Verizon is boosting its risk-correlation analysis through use of security-event management (SEM) so it can provide a deeper level of detail about the confidentiality, integrity and availability of data in specific customer computer equipment.

http://www.itworld.com/security/60354/verizon-service-steps-analysis-security-risks