CyberSecurity Institute – Page 379 – Security News Curated from across the world

Enhanced Wi-Fi security, quality on tap for 2004

Posted on May 4, 2004December 30, 2021 by admini

As the adoption of wireless technology continues to grow among businesses and home users, two key improvements in the security and performance quality of Wi-Fi devices are set to reach wireless network users later this year.

The 802.11i standard is the complete version of the preliminary WPA (Wi-Fi Protected Access) security standard introduced last year, while 802.11e is a new standard that will improve the quality of wireless networks that transmit voice and video.

Security has been one of the biggest obstacles to the growth of wireless networking. Last year, WPA replaced the flawed WEP (Wired Equivalent Privacy) protocol to shore up wireless security before the full 802.11i standard could be ratified. WPA uses a dynamic encryption key as opposed to the static key used by WEP, and it also improves the user authentication process.

The 802.11i standard adds Advanced Encryption Standard technology, a stronger level of security than that used in WPA.

Enterprises and governments, which need the highest level of security available, may have to replace some of their networking equipment in order to support the AES standard.

Newer networking equipment released within the last three months will probably have enough computational power to handle the increased performance requirements of AES security, Hanzlik said. Network managers with older wireless devices should check with their vendors to see if that equipment will support a software download of the full 802.11i standard, he said. Companies with older networking equipment must decide whether the data traveling over their wireless networks is critical enough to warrant a significant upgrade, said Aaron Vance, a senior analyst at Synergy Research Inc. in Scottsdale, Ariz. In many cases, third-party products that can secure a wireless network when combined with the WPA standard are available, he said.

http://www.computerworld.com/mobiletopics/mobile/wifi/story/0,10801,92906,00.html

Microsoft Confirms Windows XP SP2 Delayed Until 3Q

Posted on May 1, 2004December 30, 2021 by admini

The Windows XP SP2, a significant Windows client update that incorporates a host of new security features, has slipped for release until sometime in the third quarter, a Microsoft spokesman said.

On April 20, Microsoft security executives said the second-release candidate would be released in mid-May and Microsoft was still targeting to ship during the first half of 2004.

One solution provider, who requested anonymity, said Microsoft bumped into some security issues that it couldn’t resolve before June. Michael Cherry, an analyst with Directions on Microsoft, a newsletter in Kirkland, Wash., said the delay illustrates the difficulty of integrating new features with a set of constantly-evolving patches.

More info: http://www.crn.com/sections/BreakingNews/dailyarchives.asp?ArticleID=49808

Netsky Remains Big Dog In April

Posted on April 30, 2004December 30, 2021 by admini

Seven of the ten viruses Sophos named to the monthly list were variations on Netsky, with Netsky.p, Netsky.b, and Netsky.d most prominent. Variants new to the list, including Netsky.q and Netsky.t, totaled just 3 percent, proof that newer worms are not always the most deadly. Netsky.q, for instance, had the entire month of April to run, since it was first discovered March 28, while Netsky.t hit the Internet a week later on April 5.

More info: http://www.techweb.com/wire/story/TWB20040430S0004

Global IT security spend hits $42bn

Posted on April 30, 2004December 30, 2021 by admini

The Western European information security software market accounted for almost $2.5bn of that. The total represents just under five per cent of total IT spending – and slightly less than the $43bn spent on printers and multifunction peripherals last year.

However, IDC predicts that IT security spending will grow from 4.8 per cent to seven per cent of overall IT budgets by 2007. IDC also believes that the continuing focus on security bodes well for opportunities within the sector. Corporate concerns with regulatory compliance, spam, worms/viruses, and identity management will help to drive the security software market to achieve more than $5bn in 2008, representing a compound annual growth rate (CAGR) of more than 15 per cent.

“IT security investments remain a top priority for most European organizations. This, of course, gives the security industry the opportunity to move beyond a predominantly insurance-type sales approach (Fear, Uncertainty and Doubt) and instead deliver on the promise of holistic, tailor-made security concepts that enable organizations to literally ‘mind their own business’,” said Thomas Raschke, program manager of IDC’s European security products and strategies research.

According to IDC research – sponsored by Cisco Systems – human error and the time taken to maintain a network between attacks is making businesses vulnerable, concerns that help validate Cisco’s push to embed security into computer networks. IDC predicts that the mobile security software market will grow at a faster clip than the market as a whole, thanks to the boom of remote access. This segment will grow at a compound annual growth rate of 71 per cent, reaching $1.27bn worldwide by 2007.

More info: http://www.theregister.co.uk/2004/04/30/idc_security_booming/

A technical description of the SSL PCT vulnerability

Posted on April 30, 2004December 30, 2021 by admini

Exploit code was made publicly available (THCIISLame.c) and rumors of a potential worm that uses the vulnerability as an attack vector are spreading the security news. This is an analysis of the vulnerability and the method of exploitation.

More info: http://security-protocols.com/modules.php?name=News&file=article&sid=1912

Computer hacking ‘costs billions’

Posted on April 29, 2004December 30, 2021 by admini

Viruses, staff misuse and hacking are blamed in the survey by the Department of Trade & Industry (DTI) and accountancy firm PwC. Most businesses know there is a problem, PwC said, and virus writing gangs are getting more sophisticated.

The average computer incident costs large companies £120,000 a time.

UK businesses are being exposed to ever-greater threats to their information systems as use of the internet and wider connectivity among companies increases, the government-sponsored survey found. The DTI’s Information Security Breaches Survey discovered that 74% of all businesses and 94% of large companies had an IT security incident in the last year, up from 44% of all businesses in 2002 and just 24% in 2000. The average UK business now has roughly one security incident a month and larger ones suffer around one a week.

The report recommended that companies invest more on security controls and that they make sure key security defences are robust and up to date. “While awareness of the threats has never been higher, many businesses are still finding their precautions are inadequate,” warned PwC’s information security partner Chris Potter. “What this survey shows is that too many companies have waited until an incident hits them before putting counter-measures in place.”

Unfortunately, no computer software is immune from criminal attacks, warned software giant Microsoft. “The security skills gap illustrated in the survey is an important issue,” said Stuart Okin, Microsoft Europe’s chief security officer. “There is a need for the industry to work together to minimise risks to information security.”

Computer Associates, which helped sponsor the survey, also called for an integrated approach to security threats. Without this, it said, companies would continue to play into the hands of the hacking community.

More info: http://news.bbc.co.uk/1/hi/business/3663333.stm