India To Tighten Data-Secrecy Laws

Posted on by admini

The scandal has shaken India’s booming outsourcing industry, which provides telemarketing services, call center operations, payroll accounting, and credit card processing for hundreds of Western companies.

The government’s actions follow a report last week by a British newspaper that an Indian call center employee allegedly supplied details on the Britons’ bank accounts, credit cards, passports and drivers’ licenses to an undercover reporter for the Sun newspaper.

Karan Bahree was sacked from his job at Web designer Infinity eSearch on Saturday after the tabloid said it paid Bahree 3 pounds (US$5.40; euro4.20) for each person’s details, which included phone numbers, addresses, and pass codes.

NASSCOM said it is building a central database of all outsourcing industry employees to prevent criminals from getting jobs in the sector and threatening the data security of global companies.

http://www.securitypipeline.com/164903890

Read more

Security Execs: Under Pressure and Under Prepared

Posted on by admini

Nearly 100 percent of CSOs say they are well prepared to handle spam, malware, denial-of-service attacks, and hacker attacks, according to a survey by CSO Interchange at a conference held last week in Chicago for chief security officers.

The same survey also shows that 88 percent say their organizations are least prepared to handle inadvertent loss of data, social engineering and inappropriate use.

On top of that, another 75 percent report that their jobs have become more difficult or substantially more difficult than they were last year.

”The role of the CSO continues to become more complex,” says Philippe Courtot, co-founder of CSO Interchange and CEO of Qualys. ”CSOs now have responsibility for internal and external threats, compliance with regulatory mandates, and attention to bottom line business performance:.

The survey also shows:
– Sixty-four percent of CSOs surveyed are more concerned about compliance this year than they were last year, and 38 percent report their budget for compliance solutions grew during the past year;
– Seventy-four percent say their organization must comply with more than five laws and regulations;
– Sixty-eight percent say their security budget is less than 10 percent of their total IT budget; -Eighty-three percent outsource less than 10 percent of their security, and 40 percent do not outsource security processes at all, and
– Seventy percent say they do not receive sufficient early warning for cyberattacks.

http://itmanagement.earthweb.com/secu/article.php/3516156

Read more

CA buys firewall developer Tiny Software

Posted on by admini

Six-year-old, privately held Tiny had a staff of less than 20, all of whom have joined Islandia, New York-based CA, said Sam Curry, CA’s vice president of eTrust security management.

The acquisition closed in late May, and CA is continuing to sell Tiny’s software as stand-alone products.

Tiny also had an OEM (original equipment manufacturer) relationship with licensee customers, including Microsoft and Unisys (Profile, Products, Articles).

CA plans to incorporate Tiny’s firewall technology into its Integrated Threat Management platform, an under-development product CA plans to launch later this year. The idea is to bundle various desktop protection technologies into one system with a common interface. The platform will launch with CA’s antivirus and antispyware technology, and a later version will add Tiny’s firewall software, Curry said.

For now, Tiny Firewall is priced at US$50 per user for the desktop version and $200 for a server license, Curry said. Pricing may change when the software is added to CA’s Integrated Threat Management product, but CA also expects to continue offering the software as a stand-alone product, he said.

http://www.infoworld.com/article/05/06/27/HNcabuysfirewall_1.html

Read more

Cisco Buys Security Vendor NetSift For $30 Million

Posted on by admini

San Diego-based NetSift, a privately held, 15-employee company founded in June 2004, would add technology for deep packet processing.

On its Web site, venture capital firm Enterprise Partners Venture Capital lists NetSift on its software portfolio and describes the company as a developer of systems to protect enterprises from large-scale worm and virus attacks.

Cisco said the deal is slated to close in its fiscal fourth quarter ending July 30.

http://www.crn.com/showArticle.jhtml;jsessionid=C1DOYN21IMR3AQSNDBNCKH0CJUMEKJVN?articleID=164902960

Read more

Feds Face Deadlines on Smart ID Cards

Posted on by admini

All major agencies are required to submit implementation plans to the White House Office of Management and Budget that describe how they intend to meet the smart-card requirements outlined in Federal Information Processing Standard 201. The cards must support two-factor authentication via digital certificates, a password or personal identification number, and biometric identifiers.

The effort required for most agencies to conform to the mandates makes meeting the two October deadlines “very challenging,” said John Moore, chairman of the Federal Smart Card Project Managers Group and director of the Office of Governmentwide Policy at the General Services Administration in Washington.

Because the Personal Identity Verification (PIV) cards will control access to both physical and IT assets, IT departments within agencies have to work with their counterparts on the physical security side, as well as with badging and access-control staffers and human resources personnel, Moore said. The specification is designed to make the smart cards more interoperable than existing ones, said Curt Barker, NIST’s FIPS-201 program manager.

For instance, the U.S. Department of Defense has rolled out more than 4 million of the previous-generation cards. Although Barker said the transition is intended to be “evolutionary,” he noted that agencies such as the DOD could find things “a bit more complex” than agencies that are implementing smart-card technology for the first time.

Some of the technical details of the smart cards themselves are still in draft form, said Neville Pattison, director of technology and government affairs at Axalto Inc., a smart-card manufacturer in Austin. Large-scale manufacturing of PIV cards is unlikely to happen before the second half of next year, said Pattison, who was on a team that acted as a liaison between agencies and technology vendors.

http://www.computerworld.com/securitytopics/security/story/0,10801,102778,00.html

Read more

Gartner: Relax about overhyped security threats

Posted on by admini

Lawrence Orans, a principal research analyst, and John Pescatore, vice president and research fellow, told attendees at the Gartner IT Security Summit in Washington, D.C., not to fear going ahead with projects that use voice over IP technology, Virtual Private Networks over the Internet and wireless hot spots. The computer-security experts also advised their audience not to waste time or money on products they don’t need to meet federal regulations and protect against malware on mobile devices.

The men debunked five popular security myths:

* Eavesdropping risks makes VOIP telephony too insecure to use. Industry and the media overhype the danger of eavesdropping because it is as easy to eavesdrop on voice packets in a network as on data packets, Orans said. Companies that follow best practices to protect their data should have no trouble protecting their Internet telephony operations”.

* Malware on mobile devices will cause major business disruptions in the near future. The hype about antivirus products to protect cell phones and PDAs has been around since 2001, Pescatore said. But he said he predicted that viruses and other malware used against wireless mobile devices won’t cost more than antivirus protections against them until the end of 2007 at the earliest. More Americans need to use smart phones and PDAs with always-on wireless capability, Pescatore said. Additionally, mobile malware attacks won’t become a real threat until the users of these wireless items commonly send locally executed software”, he said.

* Viruses will not destroy the Internet. Named after Andy Warhol’s “15 minutes of fame” quip, a Warhol worm infects all vulnerable computers on the Internet within 15 minutes, Orans said.

* Compliance with government regulations equals security. The increased federal regulation prompted by Sarbanes-Oxley and similar legislation does not automatically lead to more security.

* Wireless hot spots are unsafe. The threat of “evil twins” setting up rogue access points to fool unsuspecting Internet users into thinking they are on real sites and then divulging confidential information is a red herring.

http://www.fcw.com/article89119-06-07-05-Web

Read more