Sasser shows there must be a better way

Posted on by admini

Microsoft announced an unprecedented eight patches to fix 21 vulnerabilities on “Patch Tuesday” last month, one of which Sasser’s creators exploited within three weeks.

Given the Sasser worm variants have hit 500,000 to 1 million unpatched machines to date, according to industry estimates, concern abounds that the window is rapidly closing between the time it takes vendors to identify holes and for attackers to take advantage of them.

Each new assault taking the world closer to zero-day exploits, when hackers will have the means to strike the day a new gap is announced.

Mark Nicollet, analyst for Connecticut-based research and advisory firm Gartner Inc., said the challenge is for organizations to put systems in place to end the recurring nightmare where administrators scramble to update their security software ahead of the next worm or virus, only to discover later that the patches they installed conflict with other software, causing computers to slow down or crash. We need to reach the point where blocking technology is effective enough to let us patch in a less disruptive, risky way, even without zero-day exploits.”

Eric Schultze, chief security architect for Shavlik Technologies of Roseville, Minn., said when it comes to the prospect of zero-day attacks, his biggest concern is that software experts are putting too much information in the public domain and unintentionally helping the hackers. He said researchers think they’re helping the IT community by putting detailed reports outlining the latest security flaws on the Internet for all to see. Schultze said the best approach is for researchers to “find the bug, alert the vendor and keep the rest out of the public domain.”

As the industry waits for Microsoft’s announcement and the next malicious code, some express skepticism that the zero-day attack will ever happen.

“I don’t think it’ll reach the point where hackers have a zero-time turnaround,” said Dennis Racca, president of network security provider Umbra Networks in Andover, Mass.

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci963170,00.html

Read more

Regulator says U.S. nearing Basel bank rules deal

Posted on by admini

The accord — known as Basel 2 because it would replace an existing regime — is a set of rules governing international bank capital and oversight and is focused on preventing financial problems from spreading across borders while taking into account modern risk management methods.

But Roeder said the United States will conduct an extensive survey of how the new regulations will affect the estimated 10 large U.S. banks that must follow them.

Officials have not publicly identified which 10 banks will be subject to the rules, but they must have at least $250 billion in assets or have 10 percent of their assets outside the United States.

http://www.reuters.com/financeNewsArticle.jhtml?type=bondsNews&storyID=5065845

Read more

Enhanced Wi-Fi security, quality on tap for 2004

Posted on by admini

As the adoption of wireless technology continues to grow among businesses and home users, two key improvements in the security and performance quality of Wi-Fi devices are set to reach wireless network users later this year.

The 802.11i standard is the complete version of the preliminary WPA (Wi-Fi Protected Access) security standard introduced last year, while 802.11e is a new standard that will improve the quality of wireless networks that transmit voice and video.

Security has been one of the biggest obstacles to the growth of wireless networking. Last year, WPA replaced the flawed WEP (Wired Equivalent Privacy) protocol to shore up wireless security before the full 802.11i standard could be ratified. WPA uses a dynamic encryption key as opposed to the static key used by WEP, and it also improves the user authentication process.

The 802.11i standard adds Advanced Encryption Standard technology, a stronger level of security than that used in WPA.

Enterprises and governments, which need the highest level of security available, may have to replace some of their networking equipment in order to support the AES standard.

Newer networking equipment released within the last three months will probably have enough computational power to handle the increased performance requirements of AES security, Hanzlik said. Network managers with older wireless devices should check with their vendors to see if that equipment will support a software download of the full 802.11i standard, he said. Companies with older networking equipment must decide whether the data traveling over their wireless networks is critical enough to warrant a significant upgrade, said Aaron Vance, a senior analyst at Synergy Research Inc. in Scottsdale, Ariz. In many cases, third-party products that can secure a wireless network when combined with the WPA standard are available, he said.

http://www.computerworld.com/mobiletopics/mobile/wifi/story/0,10801,92906,00.html

Read more

Microsoft Confirms Windows XP SP2 Delayed Until 3Q

Posted on by admini

The Windows XP SP2, a significant Windows client update that incorporates a host of new security features, has slipped for release until sometime in the third quarter, a Microsoft spokesman said.

On April 20, Microsoft security executives said the second-release candidate would be released in mid-May and Microsoft was still targeting to ship during the first half of 2004.

One solution provider, who requested anonymity, said Microsoft bumped into some security issues that it couldn’t resolve before June. Michael Cherry, an analyst with Directions on Microsoft, a newsletter in Kirkland, Wash., said the delay illustrates the difficulty of integrating new features with a set of constantly-evolving patches.

More info: http://www.crn.com/sections/BreakingNews/dailyarchives.asp?ArticleID=49808

Read more

Netsky Remains Big Dog In April

Posted on by admini

Seven of the ten viruses Sophos named to the monthly list were variations on Netsky, with Netsky.p, Netsky.b, and Netsky.d most prominent. Variants new to the list, including Netsky.q and Netsky.t, totaled just 3 percent, proof that newer worms are not always the most deadly. Netsky.q, for instance, had the entire month of April to run, since it was first discovered March 28, while Netsky.t hit the Internet a week later on April 5.

More info: http://www.techweb.com/wire/story/TWB20040430S0004

Read more

Global IT security spend hits $42bn

Posted on by admini

The Western European information security software market accounted for almost $2.5bn of that. The total represents just under five per cent of total IT spending – and slightly less than the $43bn spent on printers and multifunction peripherals last year.

However, IDC predicts that IT security spending will grow from 4.8 per cent to seven per cent of overall IT budgets by 2007. IDC also believes that the continuing focus on security bodes well for opportunities within the sector. Corporate concerns with regulatory compliance, spam, worms/viruses, and identity management will help to drive the security software market to achieve more than $5bn in 2008, representing a compound annual growth rate (CAGR) of more than 15 per cent.

“IT security investments remain a top priority for most European organizations. This, of course, gives the security industry the opportunity to move beyond a predominantly insurance-type sales approach (Fear, Uncertainty and Doubt) and instead deliver on the promise of holistic, tailor-made security concepts that enable organizations to literally ‘mind their own business’,” said Thomas Raschke, program manager of IDC’s European security products and strategies research.

According to IDC research – sponsored by Cisco Systems – human error and the time taken to maintain a network between attacks is making businesses vulnerable, concerns that help validate Cisco’s push to embed security into computer networks. IDC predicts that the mobile security software market will grow at a faster clip than the market as a whole, thanks to the boom of remote access. This segment will grow at a compound annual growth rate of 71 per cent, reaching $1.27bn worldwide by 2007.

More info: http://www.theregister.co.uk/2004/04/30/idc_security_booming/

Read more