Symantec – driving security deep into an enterprise

Posted on by admini

Symantec’s view is that a company’s business information is its most strategic asset and must be protected at all times.

This is not something that will be new to any business executive, especially given the number of legal and industry regulations, such as data protection and privacy, Sarbanes-Oxley and regulations regarding food safety that affect a wide variety of businesses.

This has upped the ante in the need to protect information from being altered in any way – or protecting the integrity of that information.

In order to be able to assure the integrity of business information, companies need to have the availability to scan all of the computational assets that they have in their networks to gauge the risk of vulnerabilities, security exposures and threats. This allows organisations to understand the resources that they have in place so that risk posed by security exploits that threaten the availability of those systems can be assessed.

Once the risk assessment exercise has been performed, organisations are in a better position to address those threats and can prioritise the actions that they are going to take to remediate against those vulnerabilities based on the value of the information to a company. Once a company is in the position to act on real-time security information, it is better placed to deal with incidents and disasters when they happen, and safeguard against threats in the future by establishing the policies, procedures and control mechanisms that are required for safeguarding information systems.

Using Symantec’s capabilities for monitoring and managing threats, along with real-time business reporting and analysis, companies are better able to ensure that information integrity is being achieved – taking them one step nearer to legal and industry compliance.

In line with its new corporate positioning initiative, Symantec has just announced the availability of some new products. These include the latest version of its Gateway Security Manager appliance, which provides network security capabilities including firewall, intrusion detection and prevention, antivirus policy enforcement, content filtering and virtual private network technology. This latest version extends gateway security capabilities to include mobile networks with the inclusion of a secure wireless LAN access point, making it suitable for use in remote and branch office environments as well as within the four walls of the corporate office.

Even with effective network security products, disaster can still occur, and information integrity can only be achieved if companies can recover from a catastrophic disaster affecting their networks. For this, Symantec has developed its LiveState Recovery family of products which allow full system restoration or recovery of any files on a server or desktop to ensure that information is available when needed – and hence reducing downtime to a business.

Finally, Symantec has brought out the latest version of its Enterprise Security Manager, which provides functionality for reporting on compliance with regulations, including pre-configured assessment templates designed for specific regulations, such as Sarbanes-Oxley and Gramm-Leach-Bliley.

http://www.it-director.com/article.php?articleid=12354

Read more

Biometrics early adopters reveal secrets, challenges

Posted on by admini

Gathered at the Millennium Hilton across the street from the site, attendees of the Fall 2004 Biometrics Summit heard about the challenges and benefits seen by those who would implement biometrics, both before and after the 9/11 attacks that put a greater focus on security needs.

Acknowledging that most of the 9/11 attackers used driver’s licenses to board the airplanes they would use as weapons, one presenter said biometrics should be a key tool, in conjunction with better verification of identity-proving documents, in the process of obtaining driver’s licenses.

Illinois was the first to use facial recognition technology in its DMVs, four years before 9/11, and the state is currently preparing an upgrade to its systems, said Beth Langen, administrator of the policy and programs division of the Driver Services Department in the Illinois Office of the Secretary of State. The measures have helped combat fraud, catching those who try to get multiple licenses for different identities. In all, 1,700 cases of fraud have been discovered using the facial recognition software, with 173 people claiming three or more identities.

Originally, the department had considered using fingerprint readers, but went with facial recognition for several reasons. It now contains 16 million pictures, and it is growing by 8,000 to 12,000 every day. The department had used a sign-up sheet before that, but employees who didn’t want anyone to know they came in late started ripping out pages, said Malachy Higgins, chief of administration. The office tried using card readers, but found that administering the cards was a big headache, and if they were going to be late, employees could give cards to others who went in earlier to make it appear that they were on time.

Scott Sykes, group managers of strategic technology at Capital One, encountered a lot of resistance to his ideas for bringing biometrics technology into the financial services firm. The fundamental point of resistance was whether the reduced risk, cost savings and increased efficiency outweigh the expense required, Sykes said. Biometrics readers aren’t built into laptop or desktop computers, making the readers a hassle to add into a network.

Until these hurdles are overcome, biometrics will have a hard time getting a foothold in most enterprise companies, Sykes said.

http://www.nwfusion.com/news/2004/1028biometrics.html

Read more

Businesses lack spyware protection

Posted on by admini

In a US survey of IT managers and executives, 70 percent expressed growing concern over spyware, yet less than 10 percent have installed anti-spyware software, according to a statement issued by Webroot, the Boulder, Colorado, security software company that commissioned the survey. The survey was conducted by Equation Research.

The disconnect appears to come from slow realisation of the problem and the need to put out fires before trying a comprehensive approach, said Richard Stiennon, vice-president of threat research for Webroot. “Spyware is insidious and has been installing itself for the last two or three years,” Stiennon said. “But now it’s at a flash point, where IT managers are finding computer systems are crashing, or it takes forever for systems to boot up. And when they investigate the problem, they’re finding it’s spyware.

The first response is to use the first tool you can as a point solution…but because a one-to-one [software] solution is too costly over time, they’re beginning to look at pushing out solutions to every desktop.”

The vast majority of executives and IT managers surveyed, 96 percent, feel that their existing antivirus and firewall software protect them from outside threats, according to the study. “They’re thinking that spyware is not a threat to their security but just a threat to their productivity,” Stiennon said. “That’s how they felt about spam in the beginning, too.”

However, 82 percent of those surveyed said their desktops are currently infected with spyware. A third of respondents said that spyware has been on the rise in the past six months.

Last year, the National Cyber Security Alliance said that 91 percent of 120 individuals participating in a study had spyware loaded on their computers. And virtually none of the participants realised spyware could be transmitted and installed via file-sharing programs.

http://news.zdnet.co.uk/internet/security/0,39020375,39171738,00.htm

Read more

Sourcefire touts ‘smart’ network defence

Posted on by admini

The real time network analysis offered by its Sourcefire 3D system can place security events in context and thereby help reduce the frequency on false alarms by up to 90 per cent, Sourcefire claims. Users can use the technology to enforce policies based on the correlation of detected threat with network vulnerability and asset data.

Sourcefire said its Real-time Network Awareness (RNA) Sensors score over vulnerability scanners because they provide constant feedback through passive detection of network activity rather than the snap shot offered by the “potentially disruptive” scanner approach.

In response the industry has moved towards intrusion prevention systems (IPS) which automatically block a subset of well-understood attacks.

Martin Roesch, founder and CTO of Sourcefire and creator of Snort, said that intrusion prevention and firewall technologies would converge. Firewalls alone can’t deal with problems like Nimda-style worms spreading across internal networks and stand-alone intrusion prevention technology fails to defend against anything other than well-known attacks, Roesch argued. “Intrusion prevention is a partial solution because the technology is purely signature based or, in the case of defending against DDoS attacks, rate based. Use of the technology can also creates a bottleneck on the network,” Roesch told El Reg.

He contrasted the intrusion prevention technology with Sourcefire 3D’s learn, block and correct approach. “Users could put our sensors inline if they wanted to. We can deliver intrusion prevention by other means,” he said.

Firewalls were traditionally designed to guard against network-level attacks – such as IP spoofing and port/network scans – but as more sophisticated application-layer attacks, such as worms and exploits of known software vulnerabilities, have become increasingly common a need has arisen to rejig corporate defences. That much is common ground between Sourcefire and intrusion prevention systems (IPS) vendors.

Leading IPS vendors, such as Top Layer, argue that rather than loading extra application-aware intelligence into firewalls better performance can be obtained by using standalone intrusion detection and prevention, such as its Attack Mitigator IPS 5500. It would argue its hardware-based technology is superior at automatically blocking attacks.

Sourcefire 3D, released in the US earlier this quarter, is available in Europe from today (28 October).

http://www.theregister.co.uk/2004/10/28/sourcefire_3d/

Read more

A Snapshot of Security Project Plans, the Security Market and Vendor Mindshare

Posted on by admini

From the perspective of corporate security projects:
– The fastest growing project space is Authentication, Encryption and Intrusion;
– Security management is still just the leader but the trends show it deminishing over time;
– Wireless security is growing slowly as a priority item.

For entreprise software:
1. Directory Services with 30% percent of respondents consistenly stating that this has been their number 1 priority for the past 12 months.
2. ERP, which has taken over from CRM.
3. CRM
4. Groupware
5. Vertical industries
6. Document Management

For Web Technologies:
1. Web Service, showing very strong upward trending over the past 12 months.
2. Other
3. Site Development
4. Portals
5. E-Commerce
6. Content Management

Other charts showing the top ten security vendors and the October 2004 priorities.

Research comes from IDC and ZDNET.

http://news.zdnet.com/2100-9596_22-5429425.html?part=rss&tag=feed&subj=zdnet

Read more

Trends in Web Application Security

Posted on by admini

This article highlights both technical and business trends in web application security.

Traditionally, vulnerability analysis (and its management) has been focused at the network or operating system level. Trends are leaning towards merging the ability to scan for network vulnerabilities and application-level vulnerabilities together. The goal in this merging of network and application vulnerability analysis is the ability to use data found from one level and drive a more focused approach for the other level.

Another key area where we will see more integration is in the area of network management consoles. Currently, most consoles are geared towards soliciting network device information (e.g. firewalls). On the network side, consoles can be set up to attach patch management solutions to notifications of problem detection. However, many web applications are proprietary and thus unique to a particular customer or department within a large corporation.

Mercury Interactive, a major player in automated testing tools, recently announced partnerships with some leading application security testing companies that provide an integrated solution between Mercury’s testing products and the vendors’ application vulnerability detection tools. Some vendors have created development tools for enhancing code security, but to date, sales of these tools have been relatively poor. In addition, most of these code scanning tools are unable to provide complete application awareness and can only focus on a specific module of code.

This has started to prompt some awareness in the developer community. However, it is still too early for application tools to incorporate sophisticated integration, as web application security analysis still lies primarily in the hands of security professionals such as penetration testers, QA engineers, and auditors.

While no formal direction has yet been established, industry trade groups, such as the Information Technology Association of America (ITAA), are anticipated to start providing guidelines for web application security for offshore code.

With the rise of cross-site scripting (XSS) attacks, tools are still only focused on inline detection (the ability to attack and detect success in the same process). Complexities yet to be tackled include performance (as large amounts of data from the web application and user input need to be stored and referenced with each new interaction) and accuracy (by reducing false positives). For example, some large financial organizations have recently had issues with cross-frame scripting (XFS), a particular type of phishing attack that poisons a single frame in a page. While web services has been very slow in mass adoption, some users have sites and online applications that depend on web services, and therefore have an urgent need to test for web services vulnerabilities.

For the most part, vendors in this space have focused on simple detection techniques such as XML (malformed) schema based attacks and applying known web application vulnerabilities in non-XML applications to XML applications. This generally involves the ability to write scripts to address new and cutting-edge vulnerabilities. Vendors have been using scripts that use languages ranging from ones that look like Visual Basic to JavaScript and Nessus’ NASL language.

For the immediate future, most well-defined tools will choose multiple script languages to incorporate open source tools as well as proprietary methods.

Another area poised for substantial increases in effectiveness is the ability to handle testing of client-side technology for web applications.

Some of the more prominent standards include the Application Vulnerability Description Language (AVDL) and Web Application Security (WAS), which are both XML-based standards.

http://www.securityfocus.com/infocus/1809

Read more