Skip to content

CyberSecurity Institute

Security News Curated from across the world

Menu
Menu

Security: It’s just a matter of asking the right questions

Posted on April 11, 2005December 30, 2021 by admini

Almost all companies test for vulnerable versions (i.e., missing security patches) and default configuration files.

Before investing any time or money in securing or verifying the security of an application, first perform a risk assessment.

The following are areas that should be considered:
– Scripting;
– Enumeration;
– Passwords;
– Sessions;
– Error handling;
– Field variables;
– Code commenting;
– Session time-out;
– Session cache; and
– Network parameters.

http://insight.zdnet.co.uk/internet/security/0,39020457,39194163,00.htm

Read more

The future of IT security is fewer walls, not more

Posted on April 8, 2005December 30, 2021 by admini

A roving gang of European chief information security officers claims the key to better security is less walls not more — a concept they call deperimeterisation.

Security is a process not a product, says Jericho. Establish open standards for identity management, digital rights, encryption and data-level authentication, and we can eventually do away with the rest of the security infrastructure altogether while maintaining commercial and operational flexibility. But because the Jericho Forum is user-led, it is honest about the problems and pragmatic about a gradual introduction of these ideas.

ZDNet UK spoke to one of Jericho’s founders, Paul Simmonds, global information security director of chemical giant ICI, about the ideas behind deperimeterisation and pushing the organisations unique take on security to the US.

http://insight.zdnet.co.uk/internet/security/0,39020457,39194164,00.htm

Read more

IMlogic Threat Center Reports Steady Rise in Targeted Attacks on Instant Messaging Networks in Q1 20

Posted on April 5, 2005December 30, 2021 by admini

During the first quarter of 2005, IMlogic issued more than 15 priority alerts to enterprises and IMlogic Threat Center subscribers in response to the increasing frequency of reported IM threats. 75 new threats on public IM and peer-to-peer computing networks were discovered in the first three months of this year.

More than 50 percent of the incidents reported to the Threat Center during the first quarter of 2005 involved attacks at workplaces.

Only 11 percent of the incidents tracked by the Threat Center involved attacks on known vulnerabilities on IM applications.

The group said that 82 percent of the incidents reported to it involved IM virus or worm propagation, while 14 percent dealt with IM file transfer hijacking.

The Bropia, Kelvir and Serflog worms were found to be the three most frequently detected IM infections at workplaces.

The report released today by the IMlogic Threat Center provides complete data, analysis and discussion of key trends for the first three months of 2005.

More than 50 percent of externally reported incidents to the IMlogic Threat Center in Q1 2005 were attributed to enterprises and small businesses utilizing popular IM applications such as AOL Instant Messenger, MSN Messenger, Windows Messenger, and Yahoo!

The report highlights the increase in targeted IM attacks on corporate environments and the need for both enterprises and small businesses to prepare and defend against emerging IM threats.

Trend analysis provided in the IMlogic Threat Center Q1 2005 report suggests that IM-borne attacks will continue to increase as hackers capitalize on the growing popularity of IM in both consumer and corporate environments.

“The trends identified in our report will continue as IM becomes the new target for more sophisticated attacks aimed at disrupting Internet security,” said IMlogic Chief Technology Officer and Vice President of Products Jon Sakoda.

The Q1 2005 IM Security Threat Report is available free of charge by visiting the company’s Web site at www.imlogic.com/online/Q105_IMThreatReport.asp.

http://home.businesswire.com/portal/site/google/index.jsp?ndmViewId=news_view&newsId=20050405005541&newsLang=en
http://www.zdnetindia.com/news/international/stories/120002.html

Read more

Privacy Pays For Banks

Posted on April 5, 2005December 30, 2021 by admini

“In the past, online banking was all about who had the best features and functions,” says Mike Weider, founder and CTO at risk-management solutions company Watchfire Inc. “Now, issues of trust, privacy, and security are more and more a differentiator between the leaders and the laggards.”

According to the 2005 Privacy Trust Survey for Online Banking, customers with a high degree of trust in their bank are more likely to use online financial services, which generate more profit for banks than offline transactions. The study, sponsored by Watchfire and conducted by the Ponemon Institute, a management-practices research organization, also finds that trusting customers are loyal, with 55% claiming they’ve never visited another bank’s Web site. The price of that loyalty is an expectation of privacy.

Among those with a high level of trust in their bank, 57% indicated that they would stop using online services in the event of a single privacy breach. More than 82% of respondents cited identity theft as their biggest concern should a privacy breach occur.

“Having a privacy problem will have a catastrophic effect,” Weider says. “Not only will you lose a lot of customers, but they’ll be your best customers.”

Asked what steps banks should take to earn customer trust, survey respondents wanted information sharing with third parties to be limited, fewer marketing pitches, and identity verification when conducting online transactions.

http://www.informationweek.com/story/showArticle.jhtml?articleID=160500671

Read more

Enterprise security boom continues

Posted on March 31, 2005December 30, 2021 by admini

Last year the market grew 49 per cent year-on-year to €536m, with Cisco dominating with 21 per cent of the market.

Nokia is the fastest growing vendor, however, with sales increasing by over 90 per cent on the quarter.

“The security market is poised to extend its impressive track record into 2005 and beyond,” said Andy Buss, senior analyst at Canalys. “Our expectation is that 2005 will be up by more than 15 per cent over 2004. Vendors need to continue the pace of innovation and integration, partnering where necessary to ensure short time to market and to develop industry-wide interoperability.”

The biggest growth area has been in security hardware, with 65 per cent year-on-year increases. This is part of a wider move to build security into the network at a hardware level.

The reseller channel has also proved important. Juniper saw its sales grow 57 per cent after an intensive channel support programme, and the Canalys research found that the channel as a whole benefited towards the end of the year as companies started spending the last of their annual budgets.

The findings contradict statements made by Gartner last month that this year would see the start of a decline in security spending.

http://www.computing.co.uk/news/1162250

Read more

Having a problem with IT? Blame the sales rep

Posted on March 31, 2005December 30, 2021 by admini

The report — called IT Priorities — is culled from a survey of 1,400 IT decision makers from what are described as mid-sized companies in Canada, the United States and Britain.

It’s a worrying figure but, in my view at least, part of the blame is being laid at the wrong door. First, before anybody runs away with the idea that the failure of IT projects is rampant, it’s necessary to look further into the study’s findings.

In a later section of the report, Info-Tech admits the majority of IT projects are in fact delivered on time, on budget and do meet expectations. Well, some projects inevitably fail to measure up, and getting good results most of the time isn’t good enough, it seems.

Failure is failure, and the infrequent missteps are tarnishing the reputation of IT groups in the eyes of business executives, the researchers say. “Only 5 per cent of enterprises told us they were always on time,” the report states. This indicates that 95 per cent of IT shops are not delivering some number of projects on time or to the full satisfaction of the business executive. This is a major contributor to a misalignment of business and IT.” The latter statement seems a bit harsh, since IT by its very nature is imperfect.

Consider the breakable operating systems in widespread use at most companies, coupled with desktop hardware that often delivers less-than-predictable performance. As a result, it’s arguable that most businesses are accustomed to experiencing something less than perfection when it comes to technology and, by extension, IT projects (including the “successful” ones).

But let’s take the researchers’ claim at face value.

Info-Tech asserts that the top three “perceived” reasons for project failures include unrealistic time frames, staff shortages and poorly defined project scopes — results that would make most IT consultants positively giddy, given that two of the three are practically open invitations for their services. These may be contributing factors, but in my experience the bottom line is simply that failures sometimes occur and people, even highly skilled IT workers, occasionally make mistakes. IT departments can’t always anticipate what will go wrong and they don’t usually know when they’re embarking on a doomed project. But when laying blame for problems, here’s something the researchers may not have considered.

Vendors, rather than IT staff, might be the ones ultimately at fault in some of the most serious project failures. That assertion comes as a result of some rather passionate comments made during an informal session of IT World Canada’s most recent chief information officer exchange, a regular meeting of top IT executives from government, finance and manufacturing. A pet peeve expressed at the meeting was that many IT companies overstate their products’ capabilities.

In some instances, it was reckoned that an overzealous salesperson sold a bill of goods that fell well short of what a CIO may have thought was being purchased. This becomes a particularly nasty problem when the shortcomings of the solution don’t become apparent until the project is well under way. Those shortcomings can be the primary reason behind a failed (or at least late) project.

And instead of the vendor, it’s the IT staff doing the integration work that tends to take the heat from management.

Let’s be clear about the magnitude of this sort of problem. I heard this complaint again and again from seasoned CIOs, people who have lots of technical knowledge and experience dealing with vendors. Distressing, too, is the fact that senior executives of these technology suppliers may not be entirely aware of this customer dismay, or of the less-than-forthright sales practices of some of their own reps. False claims by individual salespeople suggest a short-sighted approach aimed at getting the deal done, hitting the sales target and moving on to the next prospect. It’s a situation that frustrates the customer, who wonders why the supplier doesn’t take the time to understand his business and send knowledgeable salespeople who can propose solutions that might actually be useful.

http://www.globetechnology.com/servlet/story/RTGAM.20050331.wmclean31/BNStory/Technology/

Read more

Posts navigation

  • Previous
  • 1
  • …
  • 306
  • 307
  • 308
  • 309
  • 310
  • 311
  • 312
  • …
  • 421
  • Next

Recent Posts

  • AI/ML News – 2024-04-14
  • Incident Response and Security Operations -2024-04-14
  • CSO News – 2024-04-15
  • IT Security News – 2023-09-25
  • IT Security News – 2023-09-20

Archives

  • April 2024
  • September 2023
  • August 2023
  • July 2023
  • June 2023
  • April 2023
  • March 2023
  • February 2022
  • January 2022
  • December 2021
  • September 2020
  • October 2019
  • August 2019
  • July 2019
  • December 2018
  • April 2018
  • December 2016
  • September 2016
  • August 2016
  • July 2016
  • April 2015
  • March 2015
  • August 2014
  • March 2014
  • August 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • October 2012
  • September 2012
  • August 2012
  • February 2012
  • October 2011
  • August 2011
  • June 2011
  • May 2011
  • April 2011
  • February 2011
  • January 2011
  • December 2010
  • November 2010
  • October 2010
  • August 2010
  • July 2010
  • June 2010
  • May 2010
  • April 2010
  • March 2010
  • February 2010
  • January 2010
  • December 2009
  • November 2009
  • October 2009
  • September 2009
  • June 2009
  • May 2009
  • March 2009
  • February 2009
  • January 2009
  • December 2008
  • November 2008
  • October 2008
  • September 2008
  • August 2008
  • July 2008
  • June 2008
  • May 2008
  • April 2008
  • March 2008
  • February 2008
  • January 2008
  • December 2007
  • November 2007
  • October 2007
  • September 2007
  • August 2007
  • July 2007
  • June 2007
  • May 2007
  • April 2007
  • March 2007
  • February 2007
  • January 2007
  • December 2006
  • November 2006
  • October 2006
  • September 2006
  • August 2006
  • July 2006
  • June 2006
  • May 2006
  • April 2006
  • March 2006
  • February 2006
  • January 2006
  • December 2005
  • November 2005
  • October 2005
  • September 2005
  • August 2005
  • July 2005
  • June 2005
  • May 2005
  • April 2005
  • March 2005
  • February 2005
  • January 2005
  • December 2004
  • November 2004
  • October 2004
  • September 2004
  • August 2004
  • July 2004
  • June 2004
  • May 2004
  • April 2004
  • March 2004
  • February 2004
  • January 2004
  • December 2003
  • November 2003
  • October 2003
  • September 2003

Categories

  • AI-ML
  • Augment / Virtual Reality
  • Blogging
  • Cloud
  • DR/Crisis Response/Crisis Management
  • Editorial
  • Financial
  • Make You Smile
  • Malware
  • Mobility
  • Motor Industry
  • News
  • OTT Video
  • Pending Review
  • Personal
  • Product
  • Regulations
  • Secure
  • Security Industry News
  • Security Operations
  • Statistics
  • Threat Intel
  • Trends
  • Uncategorized
  • Warnings
  • WebSite News
  • Zero Trust

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org
© 2025 CyberSecurity Institute | Powered by Superbs Personal Blog theme