By Bob Violino
InfoWorld (US)
July 27, 2010

SAN FRANCISCO - Is your company’s data under surveillance by foreign spybots looking for any competitive advantages or weaknesses they can exploit? This might sound farfetched, but such electronic espionage is real. It’s an insidious security threat that’s a lot more common than you probably realize.

As an IT or security executive, determining whether your organization is under attack via this seemingly undetectable threat — and putting in place adequate technology and procedural safeguards — should be a high priority. The stakes are too high to ignore the problem.

[ Not all corporate espionage is high-tech; find out how to stop low-tech spies. | InfoWorld's Roger Grimes says you should lure spies with honeypots. | Master your security with InfoWorld's interactive Security iGuide. ]

Security experts believe that a growing number of companies are being spied upon electronically by sources from other countries, most notably China. What makes these attacks so troublesome is that their techniques are often undetectable by the usual security tools. Electronic spies try to get into systems without causing disruptions, so they can quietly gather information over a period of time.

These types of threats are much harder to deal with than untargeted attacks because they never become widespread enough for security vendors to observe reliably. As a result, security software and other tools that detect known attacks don’t identify these threats. Also, an attack that’s aimed at a particular target can be designed to get around whatever combination of defenses is in place. And the people who launch electronic spying attacks go to great lengths to prevent the targets from detecting the threat.

Although the problem is largely hidden, it is real and serious.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By J.F. Rice
Computerworld (US)
July 26, 2010

FRAMINGHAM - How did I get overlooked? I just found out my company’s IT department has been working on a plan to reorganize our Windows Active Directory architecture and settings. Naturally, when I heard about this, I figured I needed to get involved. After all, Active Directory is all about security. It is at its core a tool to manage user access and permissions. Therefore, I need to be a part of the design team, if not running the whole show. I have some important considerations I’d like included in the new design. This is a perfect opportunity to optimize our security techniques and make improvements to our Active Directory infrastructure.

So imagine my surprise when I found out that our IT department’s Windows gurus have already completed the new design. Not only that, but they also spent a lot of hours with Microsoft professional services in design sessions. This was paid for as part of our premier support plan, and it’s already used up. When I asked for an opportunity to sit down with the Microsoft engineers to review the design and add my feedback and input, I was told the engagement has already ended. Somehow, I completely missed the boat, and I never even knew there was a boat until it was too late.

How did this come to pass? We are all working a lot harder these days, due to the economy and its associated cuts, staffing reductions and budget limitations. Everybody’s wearing multiple hats and working on many things, so there’s not always time to step back and look at the big picture. Also, in this case, I think they were in a rush to get the design done and then move on to other things, and involving me might have been perceived as adding additional complexity that would slow things down. I admit that’s probably true, but sometimes it’s good to slow down a little bit in order to do things right.

In any case, now that I’ve been left behind, I’m trying to run to catch up. The design is already done, but I’m hoping I will have a chance to make a few tweaks. In designing an Active Directory architecture, there are a lot of choices that fit different business and security needs. We can go with a single domain, or multiple domains, or hybrid approach with child domains, all of which have their own merits and drawbacks. The way our business is structured, I think a multiple domain approach within a single Active Directory forest makes sense, but the design calls for a single domain. We can also distribute domain controllers regionally, and even break up the Active Directory server roles. Our current design relies on centralized domain controllers, which I think will cause problems with some of our remote sites.

Our design team also decided on structuring Organizational Units (OUs) based on geographic locations rather than business groups, a decision I think will not be ideal for our situation. We have a need for different policies in different business units, rather than in different locations, and that’s really the point of OUs. Finally, to save costs, the decision was made to use our main Active Directory domain controller as a corporate file server, which is not considered a best practice. Domain controllers should ideally be dedicated to the Active Directory function and not used for other purposes.

The best I can hope for at this point is a compromise on some of these issues, because it’s too late to start over and change everything. I’ll pick the ones I think are most important or least intrusive on the design and try to change what I can. As for the larger issue of why the security manager was not involved in the design of what is essentially a platform for security policy enforcement, I’m taking that up with my CIO to see what can be learned from this experience to avoid being left out in the future.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Gregg Keizer
Computerworld (US)
July 20, 2010

FRAMINGHAM - A security researcher on Sunday published a working exploit of a critical Windows vulnerability, making it more likely that attacks will spread.

According to a security advisory issued Friday by Microsoft , hackers can use a malicious shortcut file, identified by the “.lnk” extension, to automatically run their malware simply by getting a user to view the contents of a folder containing the shortcut. Malware can also automatically execute on some systems when a USB drive is plugged into the PC.

All versions of Windows, including the just-released beta of Windows 7 Service Pack 1 (SP1), as well as the recently retired Windows XP SP2 and Windows 2000, contain the bug.

Sunday, a researcher known as “Ivanlef0u” published proof-of-concept code to several locations on the Internet. Later that day, Belgian researcher Didier Stevens — who in late March revealed a serious design flaw in Adobe’s PDF document format — confirmed that Ivanlef0u’s code could be tweaked to create an effective attack.

Stevens also announced that he’d tested Ivanlef0u’s exploit against a tool he’d written a year ago, and said that the utility successfully blocked attacks launched from USB flash drives and CDs. “You can use Ariad if you want to mitigate attacks with these shortcut links until Microsoft releases a patch,” Stevens said of the tool in a Sunday blog .

In the blog post, Stevens illustrated how to set up Ariad to block executable files, including .lnk files, from running from a USB or CD drive. He also urged users to read Ariad’s online documentation , and warned them that running it could be risky. “Ariad is a mini-filter drive, and as such operates inside the Windows kernel,” Stevens said. “Bugs in kernel software can have grave consequences: the dreaded BSOD [Blue Screen of Death]. So please test this software first on a test machine you can miss.”

Stevens clearly told rookie users to steer clear of the tool. “I don’t want inexperienced users to install this. [Ariad] is not user-friendly,” he said.

Microsoft’s defensive advice thus far has been limited to recommending that users edit the Windows registry to disable the displaying of all shortcut icons, and to switch off the WebClient service.

Another researcher didn’t think much of Microsoft’s workarounds. “This is highly impractical for most environments,” argued Chester Wisniewski , a senior security advisory with Sophos. “While it would certainly solve the problem, it would also cause mass confusion among many users and might not be worth the support calls,” he said. “Microsoft also suggests disabling the WebClient service that is used for WebDav. If you are not a Microsoft SharePoint customer this may be a solution, but many organizations rely on SharePoint so this is limiting as well.”

The U.S. Computer Emergency Readiness Team (US-CERT) added an alert of its own Saturday and pointed out that USB flash drives were a likely, and dangerous, attack vector. “Depending on the operating system and AutoRun/AutoPlay configuration, exploitation can occur without any interaction from the user,” said US-CERT.

The team also urged Windows users to disable AutoRun and AutoPlay, two Windows functions that have long been used by attackers to commandeer PCs. AutoPlay is disabled by default for removable drives on Windows 7 and Server 2008 R2, but is on by default on other versions going back to Windows XP SP2.

Complicating matters is the fact that Microsoft dropped Windows XP SP2 from support last Tuesday, meaning that when it does produce a patch, it will not deliver the fix to PCs running XP SP2.

Several security experts contended over the weekend that XP SP2 was vulnerable to attack, even though Microsoft did not specifically list it or Windows 2000, the other edition retired from support last week, as affected.

“Noticeably absent from the list are Windows 2000 and Windows XP SP2 as they are no longer supported,” said Wisniewski. “They are, however, definitely still vulnerable.”

In its advisory, Microsoft stuck to its policy of not naming Windows editions that it no longer supports and so does not test. Instead, the company again pressed customers to upgrade from Windows XP SP2 to SP3, or from either Windows 2000 or XP SP2 to the newer Windows Vista or Windows 7.

Stevens suggested that his Ariad tool might be the long-term solution for XP SP2 users. “As it is expected that Microsoft will not release a patch for Windows XP SP2, Ariad can offer permanent mitigation,” he said.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Jaikumar Vijayan
Computerworld (US)
July 9, 2010

FRAMINGHAM - Research in Motion (RIM) Wednesday padded the latest version of its BlackBerry Enterprise Server software with new security features designed to accommodate the growing use BlackBerry devices in corporate settings.

The updates, part of the new Blackberry Enterprise Server (BES) Version 5.0.2 released today, include a new tool dubbed the Individual-Liable Devices Policy that lets users separate personal use from corporate use of the device. The version also includes technology that allows corporate data stored on personal BlackBerry devises to be erased remotely.

Though the new version is a relatively minor point release of BES, the security tweaks address an important need, said Jack Gold, an analyst at J. Gold Associates.

Increasingly, companies that are unable or unwilling to buy such technologies permit employees to access enterprise applications and data from personal smartphones such as RIM’s BlackBerry device, Gold said.

Some companies address security risks by only allowing workers to use approved devices, he said.

Others allow the use of many devices, but have separate data access policies for each, he added. For instance, a company might have a policy that allows Android users to only access enterprise e-mail, while a user of a personal BlackBerry might have wider access to enterprise applications, he said.

RIM’s newest security enhancements appear designed to make it easier for security administrators to allow employees to use personal BlackBerry’s for corporate uses, Gold said.

The company’s support for remote removal of corporate data from employee-owned devices for instance, allows for more granular control over personal devices, he said.

“BES was always able to remotely remove data on your device. Your company could simply send a ‘kill-pill’ and your device would be trashed,” he said. “Now they wouldn’t need to do that. They could just delete the corporate part and leave your personal data alone,” he said.

Meanwhile, the new Individual-Liable Devices Policy will allow users of personally-owned BlackBerry’s to access their personal e-mail and calendar, and allow calls on personal voice plans, even while the device is locked out of corporate use. The policy can also prevent users from accessing organizer data such as tasks, contacts and calendar entries from within social networking applications, according to RIM.

The updated BES also includes new self-service options that allow users connected to a BlackBerry Enterprise Server to reset their device password, lock the device or remotely delete all data in case the BlackBerry is lost or stolen. Previously, such functions could only be carried out by an IT administrator, according to RIM.

Such features should, in theory at least, reduce the risk of “cross-contamination” that can result when personal devices are used for corporate purposes, Gold said. “Now as an IT administrator I can tell you to go out and buy your Blackberry and use it for your own personal use, because in theory at least I can separate your stuff from my business stuff,” he said.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By J.F. Rice
Computerworld (US)
June 28, 2010

FRAMINGHAM - IN A RECENT COLUMN, MY SECURITY MANAGER’S JOURNAL COUNTERPART, MATHIAS THURMAN, WROTE ABOUT SECURING VIRTUAL DESKTOP ENVIRONMENTS. MY COMPANY IS GOING THROUGH THE SAME EXERCISE OF EVALUATING VDI AS A REPLACEMENT FOR TRADITIONAL DESKTOPS. AS MATHIAS POINTED OUT, THE CONCEPT OF VIRTUALIZING THE APPLICATIONS THAT RUN ON THE SYSTEM DOES NOT SUBSTANTIALLY CHANGE THE THREAT LANDSCAPE, NOR DOES IT MODIFY THE COUNTERMEASURES WE PUT IN PLACE TO PROTECT AGAINST THOSE THREATS.

This is true in the server world as well. Physical servers are being replaced in our data center by virtual machines, but these VMs look and feel like any other server platform from the security perspective. Whether the server is real or virtual makes no difference from the network point of view. They all look the same on the wire.

But what about Internet-based services? Cloud computing and software-as-a-service (SaaS) are beginning to proliferate in my company’s network, and I find myself struggling with trying to apply the best practices we are using inside our network perimeter to outside companies beyond our control. I believe that the risks associated with Internet-based SaaS services are a combination of those risks associated with traditional data center environments in addition to those of Internet-based services, added to a new set of risks that arise from the convergence of private and public environments.

We are using SaaS-based services, including the well-known Salesforce.com and Google Docs, other Web services, and outsourced third-party support and staffing services that connect into our network over the Internet. These services need to access some of our internal network infrastructure in order to work, such as our Active Directory authentication systems. Yet we don’t really know that these outside companies will treat that access with the same care and caution that we use, and how do we know they are safe? All we really have is contractual reassurance. That’s why I insist on a SAS70 certification from every potential SaaS vendor before we start any discussions about connecting to their service. While SAS70 may not completely guarantee that a vendor’s service is safe, it at least establishes that the vendor has given some thought to protecting its customers’ information assets.

When evaluating the security of SaaS services, I am concerned about some additional factors beyond traditional data center computing that need to be addressed. For instance, knowledge and control of the location of data are important for many reasons, with regulations being near the top of the list. In the past, service providers knew exactly where their customers’ data resided, because individual servers were housed in specific data centers with minimal interaction from the providers. But in newer, distributed cloud environments, providers have many data centers and leverage virtualization of servers, network, and storage to provide elastic environments that can be scaled on demand. This means that finding the physical location of data can be difficult, and it can move around without warning.

And where is my data? I’m concerned about service providers commingling my company’s sensitive and private data with that of other customers. Service providers typically store data from multiple customers on the same hardware. They state that controls are in place to provide logical separation of data for different customers, but validating that competitors can never access our data either intentionally or accidentally may not be possible. And how do we that ensure our data is completely removed in the situation where we want to terminate our contract with the cloud provider?

I’m also concerned about whether a service provider’s physical servers are located in different places, especially when those locations are outside the U.S., and possibly even in risky locales. Ensuring the integrity and confidentiality of data when the infrastructure resides physically in other countries, especially those hostile to the U.S., can be impossible.

Mission-critical services require some thought and planning around redundancy. An established practice is to assume that any given service will fail, and plan appropriately by using redundant providers. But if the service itself goes down, we typically have defined SLAs that are published by the service providers with a provision for a cash refund or service credit based on the cost of the service, not the cost of losses due to business downtime. SLAs for SaaS services are also affected by Internet reliability — if our Internet link goes down, access to data is impossible and there is no remediation, and our people can’t work. So the Internet itself has become a mission-critical application that our workers can’t live without, and it needs to be highly available, otherwise work will stop when there is no offline alternative.

Despite these challenges, my company, like many others, continues to march forward toward virtual hardware and software services, so I’m doing the best I can to secure them. There’s always a new challenge in my security world, which is why I like my job. It seems like there’s never a dull moment.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By AvantiKumar
MIS Asia
June 28, 2010

REDMOND, WASHINGTON - IN AN ONGOING EFFORT TO PROMOTE A MORE SECURE COMPUTING ENVIRONMENT, SOFTWARE GIANT MICROSOFT HAS INCREASED ITS EFFORTS TO SHARE ITS IN-HOUSE SDL [SECURE DEVELOPMENT LIFECYCLE] PRACTICE THROUGHOUT THE INDUSTRY. ADOPTION OF THIS SECURE ARCHITECTURE WOULD HELP REDUCE THE NUMBER OF VULNERABILITIES AS WELL AS PROMOTE CONTINUOUS IMPROVEMENTS, IT SAID.

“SDL is secure by default and has a long history within the company,” said Microsoft senior director, Trustworthy Computing Security [TwC], security engineering strategy, Steve Lipner, who has a 40-year career in information security.

“The push to greater security has achieved rapid improvements but security must be integrated into the software development lifecycle,” said Lipner. “SDL comprises all the phases of creating, developing, and maintaining software and solutions: training, requirements, design, implementation, verification, release, and response.”

He said Microsoft founder Bill Gates launched the Trustworthy Computing [TwC] initiative in 2002. “By April 2003, TwC received a push and became a security ’science’. Its mission was to identify and remove new classes of vulnerabilities as well as provide a security ‘audit’, in effect an independent review.”

“Currently, Microsoft continues to expend considerable effort in sharing security knowledge through various programmes as well as online information sites such as MSRC [Microsoft Security Response Centre] bulletins, responsible for delivering the security updates every month,” he said.

The Switzerland approach

“An example of more strategic industry relationships is SDL Outreach–or the Switzerland approach–which began in the 2004-2006 period,” Lipner said. “This is when Microsoft began to share SDL information aggressively. This also included focus on popular third party downloads and expansion beyond the browser ecosystem.”

“Applying SDL helps to secure our mutual customers, as well as to exchange best practices, and better equip the development community,” he said. “The outreach programme is conducted under mutual NDAs [non-disclosure agreements] and is resourced with a team that comprises a developer/tester expert and relationship/engagement manager,” he said. “Security is a neutral territory, hence, the term–the Switzerland approach.”

One of the SDL partner firms, EMC-owned Archer Technologies, eGRC solution manager, Steve Schlarman, said its compliance solution followed the SDL framework.

“The Archer solution is about enabling and managing all three aspects of GRC– governance, risk, compliance,” said Schlarman. “Enterprise GRC has multiple aspects around the managing of risk across different domains such as finance, IT, operations and legal.”

“Microsoft’s SDL is translated into an authoritative source for benchmarking along with other Archer-provided Authoritative Sources,” he said.

End-users helped to make Office 2010 stronger

Microsoft senior security programme manager, Brad Albrecht, said: “The SDL concept within the TwC approach helped to proactively prepare the Office 2010 product through driving security and privacy across Office client and server.”

“Office now has features that include encryption, digital signatures, and protection technology,” Albrecht said, adding that his team’s role includes being a central source of provisioning validation tools.

“We found and fixed 16,000 security bugs within the Office development lifecycle through fuzzing techniques that dived deep through about 300 file formats,” he said.

“Feedback from end-users helped to improve the body of our validation rules,” he said. “This is critical as the ability to exploit vulnerabilities has become more sophisticated over the last few years.”

“However, SDL continually raises the bar on security standards,” he said. “A layered defence includes hardening and reducing the attack surface, mitigates potential exploits, and also helps to improve end-user experience.”

Fuzzing techniques and automation tools

“The security community is becoming more interested in fuzzing techniques,” Albrecht said. “Fuzzing first showed up in an academic paper in 1998, when ‘white noise’ was shown to crash programmes.”

“File block [such as file formats in older Office] helped to reduce the attack surface,” he said. “A configurable sandbox approach–a protected view–is a tool that gives further protection to the user through mitigating potential exploits, such as phishing e-mails.”

“Security, or trust, decisions are supported by the sandbox viewer approach, such as Office Protected Viewer, which for example opens up any attachments from the Internet with the option to edit the opened document in the protected view,” he said, adding that developing this tool took his team three years to build.

“Helps to avoid forcing choice between security and productivity,” he said. “Since 2007, the PowerPoint gatekeeper validation process blocked 100 per cent of vulnerabilities during the SDL process.”

“There have been hundreds of thousands of downloads of the released SDL tools,” said Microsoft security programme manager, Bryan Sullivan. “These cover SDL threat modelling to help in the design phase, as well as Web protection library in the implementation stage, and MiniFuzz and Binscope to help in the verification phase.”

“Automation tools make the SDL possible,” said Sullivan. “For instance, tools such as MSF- Agile + SDL Process Template, which help to manage the entire SDL process.”

During a demonstration of the threat modelling tool, Sullivan added: “People, no matter how expert they may be, cannot scale to the size of a company as big as Microsoft, so it is useful to use Microsoft tools that help to meet the security needs of the developer community.”

“Threats can be classified into STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege,” he said.

“There is a library to use while you develop your application–a Web protection library–to help developers meet security standards during development,” said Sullivan. “In addition, compiler and linker defences, such as before and after Buffer Security Check (/GS), help to separate code from data, which builds greater protection against hacking attacks.”

Microsoft’s role in Asia

IDC ASEAN research manager, Roger Ling, said: “IDC sees two paradigms, which continue to exist and best represent the current scenario. First of which is the cat and mouse paradox, which sees security vendors addressing newly discovered security threats, the standard and success of which is measured by the duration it takes to address avoiding and isolating possible outbreaks.”

“Secondly, there is the gap that exists between more advanced users who continue to leverage on security vendors to improve security posture and the remaining who focus on maintaining the status quo,” said Ling.

“As a global technology vendor with a solution line ranging from operating systems, office productivity, business solutions, server solutions, consumer applications and others, Microsoft is uniquely positioned to support the growth of information security,” he said.

“IDC sees Microsoft playing a pivotal role in bridging the paradigm gap,” said Ling. “For example, in the area of development, Microsoft can play a stronger role away from the cat and mouse paradigm and into providing developers with tools to develop more secure applications. From an angle of awareness, education will continue to play a pivotal role and given the mass appeal of its product line, Microsoft should continue to propagate its security messaging across. On top of these, industry developments like cloud computing and social networking continue to present an opening for vendors like Microsoft to address security concerns.”

“Microsoft has come a long way since it launched its ‘Trustworthy Computing’ initiative in January 2002,” said Ovum principal analyst, Graham Titterington. “It has always had a difficulty in walking the line between playing its full role in the fight to secure the IT environment and avoiding exploiting monopolistic powers.”

“This conflict has increased as it has developed its commercial security product offerings,” said Titterington. “It has entered most of the areas of activity it can. Its main opportunity now is to use all the data it is starting to collect through its Security Essentials product (the free anti-malware product) to maximum advantage for the industry as a whole.”

“In future, the industry, including Microsoft, needs to work more closely with ISPs [internet service providers] to identify and disconnect malware centres, and work more with law enforcement particularly in respect of disrupting the cash flows to the criminal gangs perpetrating malware-based fraud,” he said.

Titterington said that governments and corporates need to strengthen their defences against cyber attacks, including cyber espionage, to increase the protection of critical national infrastructure, and Microsoft may well have a significant role in this arena.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Lincoln Spector
PC World (US)
June 9, 2010

SAN FRANCISCO - The IT Department where Daniel Toth works won’t let him use open source software because they believe it’s a security risk. Is it?

No. If anything, open-source software has the potential to be safer. Not that it always is, of course.

An open-source program is one whose source code is open to anyone who wishes to study it–or improve upon it. Open-source software is usually free and often public domain. Popular open-source programs include Linux, OpenOffice, and a program you’re quite likely using to read this blog post: Mozilla Firefox.

I might also add that two of my favorite security programs, Password Safe and TrueCrypt, are open source. I wouldn’t trade them for anything.

At first glance, this seems counter-intuitive. If any hacker can read your code, why can’t they use that knowledge against you? Think of what the Rebel Alliance did with the Death Star plans in the original Star Wars.

Reality and Star Wars don’t always coincide. When everyone has access to the source code, a great many experts are able to examine that code thoroughly and determine if it really is secure. That’s prohibitively expensive if the only people with access to the code are on the payroll.

And it’s not as if closed-source programs are especially secure. People find exploits in Windows all the time.
Back in 1999, security expert Bruce Schneier wrote that “Public security is always more secure than proprietary security…For us, open source isn’t just a business model; it’s smart engineering practice.” (I checked with Schneier while researching this piece; he still stands by those words.)

But don’t be too hard on your IT department. They have to approve every program put on company computers, and checking out new programs is time-consuming. Open-source or not, they don’t want programs on their PCs that they haven’t vetted, and they don’t have time to research or test everything. Besides, they may have to answer to executives who think that k is an effective password.

Possibly Related Posts:

• Fix a Windows 7 System That Randomly Freezes
• Update Firmware On Your HDTV, Camera, Smartphone, PC
• Keep Your PC Awake, Install Apps Fast & More–Free
• Use Facebook Places
• My Keyboard isn’t Working

Check Point Software Technologies Ltd. has announced new UTM-1 Edge N and Safe@Office N appliances delivering gigabit firewall performance starting at just US$750. In an easy to deploy desktop solution designed to meet the needs of small and medium businesses and branch offices, the unified threat management appliances deliver enterprise-class security, including firewall, Intrusion Prevention (IPS), anti-virus, anti-spam, web filtering and remote access connectivity.

The new UTM-1 Edge N and Safe@Office N appliances are based on the same Check Point technologies that secure 100% of the Fortune 100. These appliances include tightly integrated security and networking features, such as Gigabit Ethernet supporting high-performance networking capabilities and seamless 3G and wireless connectivity supporting the latest IEEE 802.11n Wi-Fi standards.

“Small and mid-sized organizations increasingly face the same challenges with security, networking and compliance as larger enterprises, but have far fewer resources to manage such requirements. This is especially challenging when businesses need to establish secure and reliable communication with remote offices, such as retail outlets, branch offices or with broadband teleworkers,” said Dorit Dor, vice president of products at Check Point. “UTM-1 Edge and Safe@Office solutions enable customers to benefit from better security and leading performance in an appliance that is simple to manage and can be deployed in less than 10 minutes.”

Check Point UTM-1 Edge and Safe@Office appliances are all-inclusive, turnkey solutions. UTM-1 Edge enables customers to centrally manage thousands of remote sites from a single enterprise console, ensuring branch offices remain just as secure as corporate sites. With Safe@Office, customers benefit from integrated security and connectivity features out-of-the-box and can be easily managed by a MSSP, providing truly simple deployment for organizations with minimal IT resources. Each appliance comes with built-in management, security updates and support, providing the perfect blend of simplicity and security for small and medium businesses and branch offices.

Check Point UTM-1 Edge N and Safe@Office N appliances can be purchased through the Check Point worldwide network of value-added resellers.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Robert X. Cringely
InfoWorld (US)
June 3, 2010

SAN FRANCISCO - Yes, today is the day we honor the sacrifices of the men and women who have served our country, which apparently also includes the ritualistic drinking of malt beverages and burning of meat.

But today is also something else. It’s Quit Facebook Day — an arbitrarily chosen “holiday” where millions thousands a handful of ticked-off Facebook users throw a public tantrum and leave the social network in protest over its shameless appropriation of the data they voluntarily handed it.

[ Also on InfoWorld: Cringley isn't entirely convinced that Facebook is truly sorry for its privacy sins | Stay up to date on all Robert X. Cringely's observations with InfoWorld's Notes from the Underground newsletter. ]

Now, I do think these ticked-off users have a point. Facebook started out promising pretty strict privacy protection, far moreso than MySpace, Friendster, Six Apart, or any of the other nascent social networks of that era. Gradually, though, it’s gotten faster and looser with people’s data — kind of like a nun who’s decided to renounce her vows and gets a job pole dancing. And then you find out she has body piercings and tattoos.

(Get thee to a nunnery, indeed. But first you might want to stock up on dollar bills.)

I can understand why people are upset and want to leave. But after May 31 was picked as the day to give Facebook the middle finger, Mark “Baby Face” Zuckerberg issued a mea culpa (of sorts) and announced changes to Facebook’s privacy controls. These will probably assuage some of those who might have left, while ticking others off even more.

A recent poll has suggested that 60 percent of Facebook users might quit over privacy concerns. Other polls suggests 60 percent of people will answer yes to anything if they think a) that’s what pollsters want to hear, and b) you might give them a cookie.

As I write this, some 23,396 people have committed to quitting Facebook on the We’re Quitting Facebook page. Given that there are now an estimated 500 million registered Facebook users, that amounts to roughly 0.000000000000000000000000000000234 percent. (I may be off by a few zeros — I kinda lost track.)

Over the last minute, more people than that just quit smoking. And half of them did it by dying.

But let’s say that, like Newsweek’s Steve Tuttle or BoingBoing’s Cory Doctorow or TV tech pundit Leo LaPorte [video], you decide to quit Facebook. Where, exactly, do you go?

You can’t move over to Diaspora, since that’s mostly still just a concept cooked up by four NYC undergrads and won’t be ready for prime time (if at all) until after they’re, like, done partying over the summer, dude.

So your options are pretty limited. I’m going assume you’re already on Twitter and LinkedIn, which don’t really qualify as Facebook alternates in any case. So here are the top five, in my humble opinion.

MySpace. A perfectly fine choice if you’re an up-and-coming garage band, a 14-year-old with minimal parental supervision, or one of those nuns-turned-strippers. For everyone else, not so much.

Ning. You can create your own social network that consists of just you and your friends — a sad, pathetic little social network, but all yours just the same. And after you do, you can play God with other people’s data. Doesn’t that sound like fun?

Orkut. Faz qualquer um fora do uso de Brasil realmente este friggin’ coisa? If you don’t understand what I just wrote, then you shouldn’t use Google’s attempt to mimic Facebook, which is really big in Brazil but kinda nonexistent elsewhere.

Bebo. First, answer this quiz. Do you know who Justin Bieber is? Now name the Jonas Brothers’ latest album. You say you’ve never heard of Justin or Jonas? OMG, you are waaaay too lame for Bebo. Luzer.

Classmates. Hey, your old high school sweetheart has been looking for you. Seriously. Would they lie to you? Actually, yes, they would, if it convinced you to pony up $40 a year for a subscription. Because the only way your old flame is on Classmates.com is if he or she got suckered too.

There are, of course, 3,247 other social networks at last count, but most of those won’t be around for very long. Choose wisely — the last thing you want is to have to come slinking back to Facebook with your tail between your legs.

Now go out there and burn some meat. It’s your patriotic duty, dammit.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Leo King
Computerworld UK
June 2, 2010

LONDON - Google is moving its employees off the Microsoft Windows operating system as part of efforts to improve security, it has been reported.

Many of the internet search giant’s 10,000 employees are being urged to move to alternative systems including Apple OS or Linux, the Financial Times quoted staff as saying.

But no mention was made of staff moving to Chrome OS, Google’s own operating system that is due to launch in the second half of the year. The system is based on Linux and will only run on specifically-designed hardware.

The motivation for the move is understood to be the hacking of Google’s Chinese operations late last year. At that point, the company reportedly banned staff from installing Windows on desktop computers.

“We’re not doing any more Windows,” one employee at Google told the Financial Times, “It is a security effort.” Staff now require clearance from the CIO if they insist on installing Windows, one employee was reported as saying.

Another said: “Linux is open source and we feel good about it. Microsoft we don’t feel so good about.”

Google declined to give details. It said: “We’re always working to improve the efficiency of our business, but we do not comment on specific operational matters.”

Possibly Related Posts:

• Nokia’s candybar X3 combines buttons and a touch interface
• Yahoo proposes ‘really ugly hack’ to DNS
• Pressmart targets small newspapers aiming to go online
• How satisfied are you with your current job?
• Biggest Career Motivators, Other Than Money

By Mark Sullivan
PC World (US)
May 21, 2010

SAN FRANCISCO - Like it or not, Facebook has become a fact of life. Many of us depend on the service to share our interests and life events with our friends. In my experience, Facebook membership is hard to resist (peer pressure), and even harder to give up once you get hooked.

Though Facebook is a private business that can (within the limits of the law) do business any way it pleases, a mass user exodus over privacy issues and business practices would arguably be bad for both Facebook and Facebook users.

Facebook needs to make amends to its users for its arbitrary and poorly explained changes in privacy policy; it also needs to set forth some long-term rules of the road that users can count on. The following set of basic rights for Facebook users would be a very good start.

1. Let me know what I’m getting into (or out of). Facebook provides me with a valuable free service in exchange for giving it the opportunity to make money off of my demographic and preference data. For many users this is a completely fair bargain, but Facebook should be obligated to explain the terms of the bargain clearly to current and prospective users, giving them the opportunity to delete–or decline to create–a Facebook account.

Facebook often introduces new policies and features by touting their supposed benefits to users, while neglecting to mention how the changes might also make more user data public and generate more money for Facebook. As a matter of fundamental fairness, when it introduces a new feature or policy (such as Instant Personalization) that might expose more of my data to more people, Facebook must explain both the benefit to me and the benefit to Facebook.

2. Tell me what I’m broadcasting to the world. Facebook should devise a system that will enable me to immediately ascertain the privacy level of each piece of demographic, interest, preference, or comment data I post at the site.

3. Let me opt in to sharing my data; don’t make me opt out of it. When I add new information about myself in Facebook (my NRA membership, say, or my recent interest in baby clothes), this information typically becomes viewable to everyone on Facebook–including to people who find my profile by using a search engine. Currently I’m expected to locate and adjust the appropriate privacy setting to make that information private. But the default for most such data should be no sharing.

While I accept that some of my personal details–such as my name, photo, gender, connections, and user ID number–must be made public in order for me to participate in Facebook, all other data I choose to post on Facebook should be available to no one but me and my friends, unless I say otherwise.

4. Make privacy settings simple. I should not have to dig through layers and layers of complicated privacy settings to make sure that only my friends can see my personal data. Privacy settings should simple enough that my mother could set the privacy levels on all her data to the specifications she wants in 10 minutes. Unfortunately, as a seller of users’ posted information, Facebook clearly has a monetary interest in keeping as much of that data as possible “public”–and it sometimes seems as though the company has deliberately made its privacy settings complicated to discourage users from locating and shielding all of the data types that they wish to mark “private.”

5. Give me more control over photos. Facebook must obtain my permission before allowing another user to tag me in a photo. As it works now, I have the right to remove tags that others use to identify me by name in a photo, but I don’t have the right to approve (or reject) the tag before it appears. If a photo casts me in an unfavorable or embarrassing light, many people inside and outside Facebook (tags are searchable) may see the image before I discover it and remove the tag. Merely giving me the opportunity to remove the tag after the fact doesn’t give me enough control over my privacy; I deserve the right to approve all photo tags of me before they appear. On a related note, I should own the photos I post at Facebook; they should never become the property of Facebook.

6. Tell me what data I’m sharing with apps. One of the ways Facebook makes money is through profit-sharing agreements with developers who offer “apps” at Facebook. When Facebook offers to add an app (like “Mafia Wars” or “Farmville”) to a user’s account, it says only that the app may “pull your profile information, photos, your friends’ info, and other content that it requires to work.” This is far too vague a description of what the app is designed to do. Facebook, with the cooperation of the app maker, must tell me exactly what elements of my information the app will access.

7. What happens in Facebook should stay in Facebook. None of the contacts, friends, tags, and connections I post or create at Facebook, and none of my media uploads (photos, music, videos, and so on), should be indexable by search engines without my express permission. I joined Facebook to share information with my friends or with the wider Facebook community–not with just anybody on the Web.

8. Don’t surprise me. Facebook must give me (and all other users) 14 days advance notice when any significant change to its data management policies is imminent. Facebook must also directly and immediately notify us of bugs or mishaps and must advise us if data it holds may have been leaked or lost.

9. Accept responsibility when things go wrong. Facebook must be accountable for lost or stolen data. Because Facebook makes money from using members’ data, it should not seek to insulate itself from legal responsibility when a member is damaged by Facebook’s misuse or mismanagement of personal data. Facebook’s Terms of Use should explain clearly the risks of entrusting the site with personal information, and describe the administrative and legal options available to users whose data is leaked or misused.

10. Give me the right to quit and leave nothing behind. If I decide to cancel my Facebook account, Facebook must find and delete ALL of the personal information and media I have posted to its servers–immediately.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Sharon Gaudin
Computerworld (US)
May 14, 2010

FRAMINGHAM - Facebook took the wraps off Thursday on two new security features aimed at protecting users from phishers and other online scammers.

“At Facebook, we’re constantly working on new ways to protect you from scams and help you keep your account and information secure,” wrote Lev Popov , a Facebook software engineer, in a blog post late on Thursday afternoon.

“Today, we’re announcing some new tools and systems designed to keep the bad guys out and keep you abreast of suspicious activity so you can quickly take action to correct it,” Popov wrote.

One of the new features, now available to all Facebook users, is designed to allow users to approve the devices they use to log in and then be notified whenever their account is accessed from a device they haven’t approved, Popov wrote. (Users can access the new feature under the Account Settings page.)

For instance, if a user lists her work desktop, her laptop and her iPhone , and then someone tries to log onto her page from a different machine, security will be triggered.

The user will be notified that another system has been used to try to access her account. They’ll also receive information on how to reset their password and secure the account.

Facebook also is taking steps to block suspicious logons.

“When we see that someone is trying to access your account from an unusual device, we’ll ask the person to answer an additional verification question to prove his or her identity as the real account owner,” Popov wrote.

“For example, we might ask the person to enter a birth date, identify a friend in a photo or answer a security question if you’ve previously provided one. These questions are designed to be easy for you, and hard for a bad guy, and we’ve already seen some great results,” he wrote.

The security announcement doesn’t appear to be related to the company meeting that Facebook called , also on Thursday, to discuss its recent privacy issues.

In an e-mail to Computerworld this morning, a Facebook spokesman confirmed that the company will hold a meeting to discuss privacy concerns raised by individuals and lawmakers , but he would not say whether executives are looking to make changes to the site’s highly contentious privacy policies.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Jaikumar Vijayan
Computerworld (US)
May 12, 2010

FRAMINGHAM - Visa Inc. last week sent a fraud alert to banks and payment processors warning them to look out for a “large batch settlement fraud scheme” involving a merchant account in East Europe.

That alert is focusing renewed attention on a longstanding need for banks to tighten up the standards for authorizing merchants who accept credit and debit card payments.

Batch settlements refer to the common practice where merchants store all authorized payment card transactions that occur during a day and then send them in a batch for settlement to their acquiring bank at the close of business. An “acquiring” bank, in payment industry parlance, is the financial institution that basically vets and clears a merchant to accept payment card transactions.

In its alert, Visa said it had received reliable information from a “third-party entity” that a criminal group planned to submit a large batch settlement through a merchant account approved by a bank in Eastern Europe. “The criminals claimed to have access to account numbers and the ability to submit a large batch settlement upload to occur over a weekend,” Visa warned.

The company said it had no details about who exactly was involved or when the fraudulent activity might occur. The alert noted that the people behind the scheme were likely a “consortium of online merchants that have been trying to secure processing arrangements after being shut down at several acquirers across many geographies.”

In an e-mailed comment, a Visa spokesman said that card issuers and acquiring banks routinely monitor for unusual batch settlements. Even so, it issued the alert as a reminder to “critical stakeholders so they can take cautionary or mitigating steps” against fraud..

Avivah Litan, an analyst with Gartner Inc. said that the type of fraud Visa is warning about has been going on for several years. It typically involves certain categories of high-risk merchants, such as porn sites, which often submit fraudulent transactions using credit card numbers they have collected. Once money is moved from cardholder accounts to the rogue merchant’s accounts the funds are quickly withdrawn and the merchant drops out of the payment system, she said.

The situation is largely a result of the relatively loose manner in which merchants are approved to accept payment card transactions, Litan said. Credit card companies and acquiring banks, “need to tighten up their accreditation process and how they onboard new merchants.”

She said there are too many third parties and Independent Sales Organizations (ISO) acting on behalf of banks to approve merchant accounts, Litan said. The standards for approval used by such organizations have allowed “too many illegitimate merchants to establish accounts and access to the payment systems,” she said.

Michael Petitti, chief marketing officer at Trustwave, a firm that does PCI security audits for some of the largest retail establishments in the U.S., said that poor merchant validation is a problem — especially with e-commerce.

Sometimes, e-commerce merchants are approved for payment card transactions based on little more than their domain validation SSL certificates, he said. But SSL certificates do little more than establish the right of an applicant to use a specific domain name. The certificates are usually issued without any vetting of the information provided by the domain name holder.

Acquiring banks that are approving new e-commerce merchants for credit card transactions should, at a minimum, ensure that the merchant has acquired an Extended SSL certificate, Petitti said. Those certificates offer a much higher degree of identity validation because they’re issued only after the certificate authority has verified the legal, physical and operational existence of a company.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By John Mark V. Tuazon
Computerworld Philippines
May 7, 2010

Security software giant Symantec recently introduced their enhanced partner strategy to the market, which puts a premium on partners’ specialization of Symantec’s key products, solutions, and expertise, company executives announced Wednesday.

Symantec, considered to be the 3rd largest software company next to Microsoft and Oracle, said the re-focusing of their partner strategy would help partners differentiate from competitors, maximize profit, and help accelerate their businesses.

“We treat [our partners] as an extension of [the company itself],” remarked Eric Hoh, vice president for Asia south region, Symantec. “Channel partners play an important role in Symantec’s business. The partner ecosystem is important to us, so we keep on looking for ways to improve it.”

The cornerstone for the enhanced partner program, according to Luichi Robles, country manager, Symantec Philippines, is a deeper emphasis on specializations, which has been part of the partner strategy for many years now.

These specializations include endpoint management, data leak prevention, and SMB, which the security firm—whose business relies on a huge majority of partners, according to Hoh—have introduced previously.

They will act as badges or distinctions, Robles said, to recognize that a certain partner has a certain expertise of Symantec products or technology. “This makes sure that partners don’t only sell, but they also deliver solutions and support them,” he added.

In the same vein, Robles said the new addition to the strategy is a win-win situation for all parties. “Customers can be assured of local expertise of the products, while specializations give partners a competitive advantage over others,” he recalled.

In the coming months, the vendor said they will start rolling out a host of other fields partners can specialize on, such as storage management, e-discovery, and archiving.

Alternatively, and to assure partners around the world are highly specialized, these specializations will form part of the criteria for attaining levels in the partner ecosystem, namely Platinum, Gold, Silver, and Registered Member.

Today, Symantec Philippines has four silver, five gold, and four platinum partners in command. In the whole of Asia Pacific region, the company has over 400 specialized partners.

Partners can move up the ladder by acquiring a certain number of specializations, attending online and physical trainings, acquiring the needed resources, and taking the specified tests, Robles said.

In addition, partners who have undergone specialization trainings will become part of Symantec’s Partner Locator, which makes it easy for users to search for partners in their respective vicinities.

In the near future, Hoh said Symantec will take a step back and shift its services/consulting model to benefit the partners, by enabling them to offer consulting services to client. Currently, end-users consult directly with Symantec for their needs. “Making them services partners will enable them to maximize on their revenues by offering this as a value-add to their solutions,” he added.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By John Mark V. Tuazon
Computerworld Philippines
May 6, 2010

Software giant Microsoft is bent on reclaiming its share of the browser market with the latest version of Internet Explorer (IE8), which guarantees “accelerated” performance for Web users, local officials claimed Thursday.

Front and center to this improved user experience is a new feature called “accelerators,” a blue tab that appears upon selection of a word or a phrase, which gives users quick access to the most common things that can be done with the selected word—such as search, email, blog, and the like.

This eliminates the need for additional clicks to execute a certain function, Microsoft said, delivering a faster experience for browser users, something that the software firm promises with the latest release.

During a recent press event, Microsoft likewise debunked some myths surrounding IE’s lackluster performance in the browser race, most notably its alleged slow performance and insecure settings.

“IE has been ranked by an independent study the number one fastest browser among the top 25 websites commonly visited worldwide,” shared Ralph Sarmiento, Windows technology evangelist, Microsoft.

Sarmiento likewise claimed that IE8 is their most secure build to date, because they are the first to offer uniquely robust security features in the market. Additionally, according to a Microsoft-commissioned study by NSS Labs, IE8 fared way better than its open-source competitors, fielding an 81% mean block rate for socially engineered malware, where Firefox and Safari clocked in at only 27% and 21% respectively.

Interestingly enough, despite these touted security features, IE8 was among the first browsers to crack during the annual “Pwn2Own” hacking competition, second only to Apple’s Safari. Still, Microsoft maintains that they are looking into the highlighted vulnerabilities.

Web Goes Visual
Sarmiento went on to crack common misconceptions that IE8 is not extensible, saying a thousand-long list of plugins that touch on security, navigation, developer tools, and tabbed browsing are available at any IE user’s disposal.

Additionally, Web users can get a “slice” off of IE8’s new Web Slice feature, which takes note of a certain portion of a Website, keeping it conveniently tucked under one of the browser’s toolbars, and gives the user quick access to updates on that specific portion alone.

Sarmiento clarified, however, that not all sites are capable of being “sliced,” saying that a specific line of code needs to be added to the site’s design in order to activate the feature.

Another enhancement that made its way to the final cut of IE8 is visual search, which gives users a preview of the pages they are searching for, which makes for a more streamlined search process.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Gregg Keizer
Computerworld (US)
May 5, 2010

FRAMINGHAM - The IT department of the Pennsylvania school district accused of spying on students using their school-issued laptops took the brunt of the blame in an independent report released Monday.

According to the report, which was commissioned by the Lower Merion School District and conducted by a local law firm, the IT staff not only failed to inform school officials and administrators of the tracking capabilities of the LANrev software, but argued that telling students about the software’s ability to remotely trigger notebook Webcams would “defeat its purpose” as a way to recover lost or stolen computers.

The report also shed light on the incident that led a student and his family to sue the district, and revealed that privacy concerns had been raised by another student as early as 2008.

Lower Merion, of Philadelphia suburb Ardmore, Pa., was first sued by Michael and Holly Robbins , and their teenage son Blake, a high school student at Harriton High School, in mid-February after an assistant principal accused Blake of selling drugs and taking pills, and used a snapshot taken by the computer as evidence. Robbins claimed the pictures showed him eating candy.

The Robbins’ lawsuit is ongoing.

Saying that the district’s information services department had withheld information about LANrev’s spying capabilities from the school board, administrators and students, the report noted that among themselves, the IT staff “expressed zeal for what TheftTrack could do.” According to the report, people involved with LANrev’s TheftTrack feature repeatedly told of tracking a stolen teacher’s computer to a local residence, then to Pakistan, then back to Pennsylvania.

Since the Robbins’ lawsuit, Absolute Software, LANrev’s seller, has issued a patch that disables the function.

Virginia DiMedio, until June 2009 the district’s director of technology, came under fire for not telling school officials of TheftTrack and its capabilities, although she allegedly had several opportunities to do so. DiMedio declined to be interviewed for the report unless she was compensated for the time her personal lawyer would be billed; the district refused to reimburse her.

In August 2008, a Harriton High student intern in the IT department raising concerns about the tracking feature with DiMedio. “I would not find this a problem if students were informed that this was possible, for privacy’s sake. However, what was appalling was that not only did the District not inform parents and students of this fact…,” the student wrote in an e-mail to DiMedio.

In the same e-mail, the student proved prescient. “I feel it would be best that students and parents are informed of this before they receive their computers. And while this only slightly sways my opinion on 1:1 [the district's program to provide a MacBook to every high school student], i could see not informing parents and students of this fact causing a huge uproar.”

Both DiMedio and another IT staffer, Mike Perbix, dismissed the student’s concerns in reply e-mails.

“There is no way that I would approve or advocate for the monitoring of students at home,” said DiMedio. “I suggest you take a deep breath and relax.”

“It is only used in the case where a laptop is reported as stolen of missing,” Perbix told the student.

Actually, the district activated notebook cameras remotely for other reasons, including in the case of Blake Robbins.

In October 2009, Robbins had been issued a loaner laptop after he turned in his for repair of a broken screen; later that same day, school personnel said that he should not have been given a loaner since he had outstanding insurance fees. The IT department activated tracking in an attempt to locate the loaner, but left the photo-snapping feature on for more than two weeks, during which LANrev took 210 photographs and 218 screenshots.

On Oct. 26, Perbix noted a screenshot taken of Robins’ laptop that “included an online chat that concerned him;” he later brought it to the attention of George Frazier, the director of information services, and his boss.

In early November, several Harriton High administrators, including Lindy Matsko, an assistant principal at the school, and Steve Klein, the school’s principal, met to discuss images captured by Robbins’ computer.

“According to Ms. Matsko, Mr. Kline advised her that unless there was additional evidence that gave them a contextual basis for doing so, school officials should not discuss the images with the student or his parents because they involved off-campus activities,” the report stated. “Ms. Matsko ultimately decided, about one week later, that it was appropriate to discuss certain seemingly troubling images with Mr. Robbins and/or his parents.”

The report also disclosed that tens of thousands of photographs had been captured by the district’s LANrev software — the exact total is unknown because the IT department purged the program’s database last year in an attempt to boost performance — and that in at least two instances, Webcams were activated on the wrong laptops.

“Although we found no evidence that District personnel used TheftTrack to ’spy’ on students, or that District personnel surreptitiously downloaded images from the LANrev server, our investigation leaves unresolved questions that raise serious concerns about why so many images were captured without apparent regard for privacy considerations,” the report concluded.

Last week, the federal judge overseeing the Robbins’ lawsuit issued an order that required Carol Caliero, the district’s information systems coordinator, to let the Robbins’ attorney make copies of the hard drives of her two personal computers. The order was in response to a motion by the Robbins’ lawyer to determine whether Caliero — along with Perbix, the only school employees allowed to switch on the cameras — had used the software to spy on students, and had transferred images to her own machines.

Caliero and Perbix, both 12-year veterans of the district, were put on paid administrative leave last February, shortly after the Robbins filed their lawsuit.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Ellen Messmer
Network World (US)
April 30, 2010

FRAMINGHAM - Symantec’s announced acquisitions Thursday of data encryption specialists PGP Corp. and GuardianEdge Technologies have industry watchers wondering which products will stay and go, and how open source PGP will fare in the wake of the buyouts.

Symantec has had analysts puzzling for years about why the company has only licensed rather than bought into encryption technology, but made a bold statement today with the $370 million worth of planned acquisitions in a bid to address customer needs related to regulatory requirements and growing mobile device usage.

Also see: 2010’s top tech M&A deals

The acquisition of both companies, however, raises questions about which products and brands will survive. Symantec simply says at this point it will support products from both vendors into the future.

“There’s definitely overlap with PGP on the desktop,” points out Gartner analyst John Pescatore. “Our bet is GuardianEdge survives in the long run.”

He notes Symantec has cultivated a very close relationship with GuardianEdge, a favorite of the financial and government sectors, through OEM relationships and has integrated its technology into the Symantec Altiris management framework.
One strength of PGP is its server-side encryption and security offerings, which compete with products from vendors such as nuBridges, Voltage, Vormetrics and RSA with its BSafe toolkit. Demand is growing for server-side encryption because of the Payment Card Industry data security requirements, Pescatore says.

Symantec says PGP counts 100,000 enterprise customers with more than 1,000 employees, and 1 million small-to-midsized customers with fewer than 1,000 employees.

For its part, Symantec says it sees PGP and its public-key encryption technology as its ticket to innovations making use of key management.

Symantec is a market leader in the data loss prevention (DLP) product arena, and “for complete use of DLP, encryption is an important part,” Symantec CEO Enrique Salem told financial-industry analysts earlier this morning on a conference call to announce the acquisitions.

The PGP platform for key-management will contribute to Symantec’s focus on creating a “policy-based approach” in security, Salem said. In addition, a start-up acquired by PGP, called ChosenSecurity, offers another path into identity management related to establishing trust among users and sites, he noted.

“We will standardize on the PGP key-management platform,” says Francis deSouza, senior vice president, Enterprise Strategy group, Symantec.

PGP’s key-management technology is expected to be used as a way to manage keys for GuardianEdge, as well, deSouza says. Symantec intends to support both the PGP and GuardianEdge product lines, though the reality is there is product overlap. The PGP key-management technology is also expected to play a big role in many Symantec endeavors in cloud computing and storage.

As far as maintaining the GuardianEdge and PGP names, deSouza indicated that PGP seems to have a particularly strong brand.

But will Symantec be a steward for open-source PGP?

“We like open source,” deSouza replied, but also noted the question of PGP open source is being reviewed. “We’re evaluating it.”

Pescatore says he hopes that if they continue to support open source, which he’s inclined to think they should do, they should do it in the spirit that Sourcefire has done with open-source intrusion detection, rather than what Tenable has done with the Nessus tool. It would backfire on Symantec “if they try to be heavy-handed or go after people,” he noted.

Although both PGP and GuardianEdge are privately-held companies, there are those in the financial community that have had a peek into their numbers. PGP is about a $75 million a year company, says Joel Fishbein, software analyst at Lazard Capital Markets, and GuardianEdge is closer to $20 million.

When it comes to obtaining core encryption technologies, “Symantec is playing a little bit of catch-up here,” says Fishbein, noting that competitors such as McAfee bought SafeBoot years ago, Check Point bought PointSec, and Sophos bought Utimaco.

However, Jon Oltsik, principal analyst at Enterprise Strategy Group, thinks Symantec has done well with these deals and “Symantec got a lot more for less money.”

While it’s unclear if there was a bidding war over PGP, it is known that IBM is very close to the company.

Fishbein says he hopes Symantec, which has made large-scale acquisitions in the past, will focus on retaining “the intellectual capital of the companies,” such as the core engineering talent, among other personnel. That’s something he thinks has not always gone well for Symantec in the past, he says, and “that’s the question mark.”

For its part, Symantec acknowledges the next step is to make it a smooth transition in bringing GuardianEdge and PGP into Symantec. GuardianEdge has 80 employees, PGP has 400 employees, and there’s the expectation that most will join, though as in most mergers, there could be the types of overlap that mean not all employees end up on board.

Symantec’s deSouza says there’s the strong sense of purpose to make it all work because the acquisitions may “give us a lead position in the fast-growing encryption market.”

For those with a long memory, the bargaining and buying is full of some ironies in the go-go software industry.

The PGP Corp. acquisition by Symantec is but the latest chapter in the turbulent history of PGP, started by Phil Zimmermann in the early 1990s to commercialize his groundbreaking open-source encryption software, PGP being the acronym for what he called “Pretty Good Privacy.” In 1997, PGP, Inc. was bought by Network Associates, which eventually lost interest in PGP technology, though ex-PGP people founded the new PGP Corp. in 2002 after buying assets from Network Associates.

Symantec itself, over a decade ago, was in the desktop encryption game, even perhaps the leader, with a product called ForYourEyesOnly, Pescatore says. The company eventually abandoned it, thinking Microsoft was going to take over its target market for encryption, even though that didn’t happen.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By John Mark V. Tuazon
Computerworld Philippines
April 27, 2010

A Utah-based management software company recently unveiled its host of management software in the Philippines, latching on to the promise of achieving IT maturity in a complex and disintegrated world of the enterprise.

“IT is continually pressured to drive IT maturity, reduce costs and risks, as well as increase user productivity,” said Jean Bravo, sales director for LANDesk Southeast Asia.

Bravo said the issue lies in the proliferation of too many tools and products to solve specific problems, which end up being disintegrated. “Our maturity model aims to turn chaos to control,” she quipped, adding that their single solution to the most pressing IT problems delivers rapid ROI.

LANDesk integrated management suite boasts of seamless tools and products that fall under systems management and security management. “Our ‘tightly integrated’ solutions environment allows for better control of management and security,” Bravo said.

LANDesk’s integrated management suites are standardized in a common platform which enables the vendor to offer common features across the two management services. Integration also allows easier deployment of policies across the enterprise, and eliminates the need to maintain multiple databases, Bravo noted.

One of the products offered under the systems management suite is LANDesk’s software asset management tool, which closely tracks usage of software products and delivers comprehensive reports on ROI based on the usage and non-usage of software licenses.

Bravo shared that there were also clients who had to grapple with migration to the newly released Windows 7, a problem solved by LANDesk systems management suite. “The solution offers agnostic hardware-independent imaging which saves current software drivers in a library,” she explained. “This gives administrators an idea which programs are compatible with the new operating system.”

On the security management suite, LANDesk boasts of robust endpoint security with a renewed emphasis on data loss prevention. “Whenever removable disks are used in the office, LANDesk takes a snapshot of what’s being copied,” Bravo said. This gives administrators an idea of what files are moving in and out of the enterprise, especially that it can be viewed through a single point of administration.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Tim Greene
Network World (US)
April 28, 2010

FRAMINGHAM - Executives in charge of information security should make friends with the CFO, who can give them a broad overview of corporate priorities and see to funding the most important IT projects that protect corporate data.

Security pros should also look skeptically at industry compliance standards and avoid outsourcing security wholesale, said John Pironti, president of IT Architects, speaking at the Interop conference in Las Vegas.

Interop’s hot new tech products

CFOs have a broad view of the company and can appreciate where info security is key to corporate goals, Pironti said. Talking to them can help refine information security goals and nurture support for them in the budgeting process, he added.

Aligning those goals with corporate needs is the right way to go, not blindly following industry compliance standards such as HIPAA and PCI, Pironti said. He noted that the CEO of Heartland — which has suffered the largest public breach of credit card data anywhere — has made public statements that the company was compliant with PCI at the time of the breach. “Isn’t that scary?” Pironti asked.

Part of PCI fine print says, essentially, “If you’ve been breached, you couldn’t have been compliant,” Pironti said. Standards are good in that they give a sense of what a business community at large is doing to address common problems, but corporate risk management should be designed for the individual corporation. They can be aligned with industry standards later, but shouldn’t be driven by those standards, he said.

Information security pros should also re-evaluate their security tools periodically to avoid maintaining technologies that may not meet corporate needs anymore. He didn’t advocate dumping antivirus software, but pointed out that these products stop 35% to 40% of viruses, down from 47% last year, according to published testing.

Security executives need to distinguish between threats and risk, Pironti said. Threats are bad things that might happen, but risk is the weight given to them based on the practical consequences to the business, and that is unique to each business. “I can tell you about threat, but I can’t say how it fits into risk to you,” he said.

Pironti advocated that companies create the position of a chief risk officer (CRO) who sits on the board of directors and has the broadest possible view of the business. Such a CRO could offer guidance to CISOs about what assets to protect based on the main goals of the business.

Risk-combating programs should be separate from operational activities in order to keep continuing focus on the major risks. If risk-enforcement leaders get sucked into day-to-day operations they tend to lose focus on risk management, Pironti said.
Consultants from outside the company can help, but outsourcing risk management to them altogether is a bad idea. If their contract is canceled, they take with them knowledge of critical functions. Similarly, businesses should avoid following vendor recommendations about what it’s important to protect. “You’re the only one who can say what’s critical in your world,” he said.

Any risk management program needs enforcement with well-published consequences for failure to do so. If the risk created by the failure is low, so should the punishment. But for severe breaches that endanger network assets, punishment should be severe and include firing, Pironti said.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Computerworld Philippines Staff
April 26, 2010

Four IT executives reveal that budget constraints and lack of user support and awareness are pulling back the compliance efforts of their IT departments.

At a glance, the terms “security” and “compliance” may appear to denote the same thing—the application of safety measures. But at Computerworld Philippines’ monthly CIO Roundtable, we learn that its practice and meaning varies from one organization to another.

At the roundtable, four CIOs coming from companies with different lines of businesses explained the various ways security and compliance are met, and the reasons behind such actions. They also reveal different strategies in ensuring compliance to security policies across the organization as well as the technologies needed to help in achieving the goal.

For Ross Sherwin de Claro, Information Security Officer (ISO) of the government owned and controlled company the Philippine Amusement & Gaming Corporation (PAGCOR), compliance is “more of a guide than rules to follow” in order for their organization to succeed.

For his part, Christopher Eslava, IT manager of SYSU Group of Companies, shares that as a result of their joint venture with McCormick US, they adopted a pre-defined policy as a standard. He says that audit is done as a measure of internal control wherein data should be properly protected against lost, damage and growing internet fraud, viruses and malware.

Yet over at First Life Financial Company, Inc., the local company developed its own internal IT policies. The Assistant Manager, Information Systems Department, Marianito Alveniz says the increasing dependency on information resources forced them to comply with IT security.

Giving differing opinion and practice on compliance and security is Anton Estepa, IT manager of Marubeni Philippines Corp., a subsidiary of Marubeni Corp. in Japan which is involved in international trade. Compliance for them, he says, is “very broad” since they have different branches and companies. “Japan will give us lists of compliance then we need to select and follow. It’s either these list of compliance are regulatory by law or compliance under in-house compliance or just company compliance,” Estepa says. “For security, Japan provides us a procedure or guide on how we can comply for that certain compliance.” Estepa personally believes that focusing too much on regulatory compliance may hurt security postures and that it is essential to have a balance between compliance for security and the compliance for business.

During the meeting, Ricky Carreon, assistant vice president of MIS, Fortune General Insurance Corp., served as the event’s guest moderator and led the discussion along with CWP’s editorial group. Clarence Phua, country sales manager, of Sophos ASEAN, was also there to represent the sponsoring company.

EXCERPTS OF THE ROUNDTABLE
DISCUSSION FOLLOW:

Computerworld (Ricky Carreon): Before we proceed directly to the discussion, we’d like to know your expectations about the topic on security and compliance. I read an article on security and compliance, there is a law, there’s a regulation that we need to comply. Or is it about how we implement security?

Ross Sherwin de Claro: For us at PAGCOR, we’re quite similar to BSP (Bangko Sentral ng Pilipinas) because we’re doing the regulatory function when it comes to the gaming industry. However, right now, majority of the gaming facilities or casinos are managed by PAGCOR. But if you look into the local gaming industry, there is also online gaming involved. And we’re the ones regulating their compliance. It’s similar to BSP in a way that they’re the ones providing BSP circulars to banks.

Computerworld: So PAGCOR will enumerate all the security policies and these companies should comply?

De Claro: Yes, and the other aspect of provision security is we have competition. There’s Macau, there is Singapore. One of the missions of PAGCOR is to be competitive internationally. So definitely if we want to be competitive—we must be, in some way, comply with the international standards. That’s why we’re complying with that but not formally venturing into something like the ISO 27001. As for local information security compliance, not much is covered for us but the initiatives that we see are those of the National Computer Center and the Commission on Information and Communications Technology which are the public key infrastructure initiatives sent by the office of the president. Those are the things that we’re looking at and maybe in the next two years, we might be able to implement for the NCC and CICT compliance.

Computerworld: When you say security and compliance, as far as Sherwin is concerned, the thing that comes into your minds of course is the rules and regulations that you would want these other companies to follow, or is there a system that you would want to secure but have to comply with another regulation?

De Claro: Each industry has its own sort of best practice when it comes to compliance. It’s like there is a best practice for gaming, there’s a best practice for banking and so forth. The focus is not so much about what you need to follow but more about what you need to look at as guides, sort of a best practice or standards that have been proven effective for many organizations. So it’s more of a guide, not rules.

Estepa: For my part, when we say compliance, it’s very broad because we have different branches, different companies. First, Japan will give us a list of compliance policies then we need to select what compliance we need follow. It’s either the policies are regulatory by law or just company compliance. For security, Japan provides us a procedure or guide on how we can comply for that certain compliance. Now, for example in the Philippines, we don’t have any compliance regulatory. Actually we started only in 2000 when we were attacked by a virus. For Japan, they always comply based on the regulatory made by the Japanese government. Actually, our company right now is a member of 27001 ISP standard and we’re not the type who are required to comply with the Philippine standard or that of Singapore or Thailand. It really depends on the budget of a company branch and what it needs to comply when it comes with security.

Christopher Eslava: With our joint venture with Mc- Cormick US, they gave us a pre-defined policy that we have to follow after they conducted a yearly audit compliance check. So right now, we are following the US rules. So we have to make sure that we are complying with the standard.

Marianito Alveniz: In our case, since we are a local company, we developed our own IT policies although they are not that comprehensive. And one of our projects this year includes strengthening our IT policies. Now we consider those regulatory compliance mentioned but our focus, besides those that are from government bodies, is our internal policies.

Computerworld: Is there an increasing pressure for the IT department to be a champion of compliance when it comes to IT security? Why or why not? What factors are pushing compliance in your company?

Eslava: I would say yes, because information is very important in every business. Now we, as the IT officers and the assigned data and IT infrastructure custodian, we have to make sure that we are providing the end-user the accurate information that they need in our daily operation. This information should not be damaged, stolen, or infected by viruses and should be regularly available whenever they need it. Now in terms of what’s pushing the compliance in our company, like I said a while ago, as a manufacturing and distribution company and a joint venture of McCormick US, we comply with the predefined policies set by them. Audit is annually conducted as a measure of internal control. Data should be properly protected against lost, damage and growing Internet fraud, viruses and malware.

Alveniz: Information asset is critical to our business growthand operation. Protecting it is a significant challenge and the increasing dependency on information resources forced us to ensure compliance to IT security.

De Claro: For PAGCOR, there is definitely increasing pressure when it comes to compliance, most especially in terms of confidentiality of information. This concerns our very own bread and butter— our customers. Some of the business processes regarding information have been automated because of international competition. Locally of course, the information within that automated system must be there but with the highest level of confidentiality, not only in terms of information like computer data but the physical data as well, like printed information. So those are also critical for us. That’s the reason why there are also policies when it comes to using office equipment like printers and scanners. We don’t want the physical data to be converted into digital and go somewhere else. When it comes to factors that push for compliance, it is our internal requirements, which involves information about our customers. Second is the outside competition, locally and internationally. Third are requirements that are set up by the Philippine government like the initiatives of NCCCICT, which is about public infrastructure. They were the ones who pushed for it.

Estapa: For me, there’s not much pressure yet because like what I said, Japan sends me the list of compliance then I select only the essential compliance. I believe when the IT professional focuses on the regulatory compliance, it may hurt security postures. We need to balance between the compliance for security and the compliance for business. What Tokyo gives is general compliance for business and for IT. Now the big pressure is in Japan because the head of the IT is in Japan. So they are the ones who are making the compliance and the guidelines for the security.

Computerworld: What is your strategy to ensure compliance to security policies across the organization?

Alveniz: Some of First Life Financial’s strategies are the following: First, a management buy-in for compliance enforcement is very important, because they are the ones who will give administrative actions to employees of their organizations and their teams. Then we have to regularly review and ensure that the security architecture infrastructure is implemented using the right configuration because some malware might come into the future if not configured properly. Also, we have to ensure that proper controls are in place, it can be physical, technical, or procedural, so it depends. Then, in order to protect our information assets, counter measures to threats are highly considered. So we have to know how to kill it if a threat is able to get in. Similarly, personnel and organizational structure are also an important area which includes roles and responsibilities as well as the skill sets. So we must deploy the right skills for that specific task if problems occur. Lastly, awareness programs and education, especially for new employees.

Computerworld: Could you share a profile of your infrastructure set-up? Like how is your data being secured?

Eslava: Our head office is located in Panay Avenue, Quezon City, the database is housed there and we have branches in Novaliches and Baisa that is also in Quezon City. And we have sales offices in Visayas and Mindanao and then aside from that, we have the international company which is McCormick US. We connect through their email which is Lotus Notes. The set-up is more on a wide area network. So we have BPN connections connecting our sales offices and lease lines connecting our warehouse and manufacturing in the factory. We have the Linux firewall set for security authentication for the SAP servers which is our database and then we have remote access from mobile users through BPN. We have a BPN router for the mobile users, so basically that’s the overview of our IT infrastructure. The strategy here is just like what Nito (Alveniz) said about the awareness program. That’s the first strategy that we have. We have an information drive where we conduct orientation for newly hired employees about IT security. We also plan to include policies and procedures to our employees handbook so they will have guidelines not for labor related matter only but also for IT security. That strategy I thinkwill help us comply with IT security compliance of policies and procedures. Second is hardening the security by checking our policy and reviewing it quarterly.

De Claro: For PAGCOR, basically we have nationwide operations. We have 14 branches and there are some small sites that we own like Citystate & Ronquillo. It’s not a big casino but it is considered as one of PAGCOR’s branches.

Computerworld: When you say PAGCOR remote office, it’s a casino?

De Claro: Yes it’s a casino. Data are distributed in nature. Each branch has its own sets of data. And even within PAGCOR, it’s considered a competition. Each branch has its own target, its own loyal customers of a certain branch. It has its own marketing strategy depending on the location. Pavilion has its own marketing strategy although right now our focus is more on providing amenities. It’s a bit centralized as a standard so that wherever the customer is, he can avail it. Those are the kind of information that we protect from external threats and from the internal threats as well. We have policies implemented like the creation of passwords. Each employee has its own password that basically enforces accountability on the information. We even have policies that enforce that requirement. So right now, majority of our application are active directory integrated. We do monitor compliance. We found that sometimes there are end-users who share their passwords. So there’s a clear HR memorandum wherein if anyone is proven to have shared his or her account, he or she could be suspended or terminated because you have access to confidential information. We also review policies and update policies on a regular basis to accommodate new changes. Besides implementation, another strategy is awareness programs.

Estepa: As for our IT infrastructure, each branch has a server but the main and critical servers are located in Tower Center in Japan. So if something happens to a local server here, the servers in Japan will take over for business continuity. For compliance, we conduct awareness seminars for our employees. We also educate them regarding the restrictions imposed on them.

Computerworld: What are the stumbling blocks to full compliance of security policies or standards?

Eslava: I would say the lack of support from the endusers. Second is the cost of security treatment and then lack of information given by the vendors.

Alveniz: It is in the event of insufficient information dissemination to current employees and especially to new employees. That’s where noncompliance to IT security starts especially if takes long before you send out reminders.

De Claro: For us, actually it’s more on the people, their acceptance to the policies. The other one is budget. Because even though you have awareness programs, if you don’t have enough budget to fly people from Davao or fly in people to Manila to attend the awareness program, it spells a program.

Estepa: One of the stumbling blocks is the budget because in Marubeni, we have to discuss it first with head office. We need to defend our proposal. So that is one of our problems. We need to talk more. We need to discuss more because we need the budget.

De Claro: Actually the concern on the budget depends on the target. If the target is technology, then the cost would be hard to compromise. In our case, the issue was more on the awareness side. The strategy that we did was to utilize on what we have which is our own internal portal system.

Computerworld: How do you address that challenge on end-users for them to be compliant?

Estepa: Even if you complied there are still risks coming from your end-users. And so I inform them about our awareness policies. We post these in bulletin boards and also email them. We really warn them because in Japan it’s very strict, even if you enter only more than or less than the required number of characters for a password, you are suspended for one week.

Alveniz: In our company, we guide users through our IT literacy program but it’s not the classroom-type scheme. We do this in short messages and even put cartoon characters or images so that when it reaches them it’s easier for them to relate with and understand.

Eslava: I have to partner with the HR department because it’s more effective if warnings are coursed through them. There’s not much sting when the IT department issues a memo.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Untangling Network Difficulties
• Software blades boosts virtual security management
• Security gateway extends software blades to the edge of the network
• Kaspersky Lab zeroes in on parental control with 2011 release

By Channelworld staff
Channelworld India
April 23, 2010

BANGALORE - VeriSign has announced an industry collaboration aimed at building trusted online identity solutions - a lynchpin requirement for the widespread adoption of cloud computing and software as a service (SaaS) solutions. The industry effort combines technologies and best practices from Conformity, Ping Identity, TriCipher, Qualys, and VeriSign.

“Barriers to cloud adoption go beyond security; it’s about trust,” said Jim Reavis, executive director at the Cloud Security Alliance. “To create a trusted cloud-based ecosystem, it takes global associations like the Cloud Security Alliance and our Trusted Cloud Initiative, as well as industry leaders like VeriSign and its partners to establish identity trust solutions built on proven technologies, common standards and best practices. This industry effort is a welcome contribution to the SaaS community, and a reassuring and valuable option for enterprises aiming to confidently deploy cloud-based applications and services.”

With strong authentication from the VeriSign Identity Protection (VIP) Authentication Service, enterprises can protect data and applications from unauthorized access. VeriSign also enables encrypted transmission and exchange between the enterprise and the cloud via Public Key Infrastructure (PKI) and Secure Sockets Layer (SSL) certificates.

“Cloud computing offers organizations new options for scalable, cost-effective, and flexible IT, but to gain the full benefits of these services, enterprises have to trust the security, policies, and processes of the cloud,” said Nico Popp, Vice President Of Product Development at VeriSign. “Trust won’t happen if users worry their identities are vulnerable, or if they’re unsure whether the cloud-based service they’re accessing is legitimate. That makes identity trust the essential ingredient for cloud migration — and an industry imperative for SaaS providers.”

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Robert McMillan
IDG News Service (San Francisco Bureau)
April 23, 2010

SAN FRANCISCO - A hacker named Kirllos has a rare deal for anyone who wants to spam, steal or scam on Facebook: an unprecedented number of user accounts offered at rock-bottom prices.

Researchers at VeriSign’s iDefense group recently spotted Kirllos selling Facebook user names and passwords in an underground hacker forum, but what really caught their attention was the volume of credentials he had for sale: 1.5 million accounts.

IDefense doesn’t know if Kirllos’ accounts are legitimate, and Facebook didn’t respond to messages Thursday seeking comment. If they are legitimate, he has the account information of about one in every 300 Facebook users. His asking price varies from US$25 to $45 per 1,000 accounts, depending on the number of contacts each user has.

To date, Kirllos seems to have sold close to 700,000 accounts, according to VeriSign Director of Cyber Intelligence Rick Howard.

Hackers have been selling stolen social-networking credentials for a while — VeriSign has seen a brisk trade in names and passwords for Russia’s VKontakte, for example. But now the trend is to go after global targets such as Facebook, Howard said.

Facebook has more than 400 million users worldwide, many of whom fall victim to scams each day. In one such scam, criminals send out messages from a compromised account, telling friends that the account’s owner is trapped in a foreign country and needs money to get home.

In another, they send Web links that lead to malicious software, telling friends that it’s a hilarious or sensationalistic video.

“People will follow it because they believe it was a friend that told them to go to this link,” said Randy Abrams, director of technical education with security vendor Eset. Once the malware gets installed, criminals can steal more passwords, break into bank accounts, or simply use the computers to send spam or launch distributed denial of service attacks. “There’s just a plethora of things that people can do if they can trick people into installing their software,” he said.

Kirllos’ Facebook prices are extremely cheap compared to what others are charging. In its most recent Internet Security Threat Report, Symantec found that e-mail usernames and passwords typically went for between $1 to $20 per account — Kirllos wants as little as $0.025 per Facebook account. More coveted credit card or bank account details can go for much more, ranging between $0.85 to $30 for credit card numbers to $15 to $850 for top-quality online bank accounts.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By John Mark V. Tuazon
Computerworld Philippines
April 22, 2010

Cloud computing is slowly changing the game of enterprise computing, but qualms about its reliability and security continue to hamper its widespread adoption, industry experts and vendors said recently.

“[Cloud computing] is definitely showing a lot of promise,” said Monchito Ibrahim, commissioner of CICT (Commission on Information and Communications Technology), during Kaspersky Lab’s executive roundtable on Staying Secure in the Cloud. “But there are a lot of confusion in the market, especially regarding security.

Ibrahim said sources of these confusion emanate from varying models of cloud deployment, which include SaaS (Software-as-a-Service), PaaS (Platform-as-a-Service), and IaaS (Infrastructure-as-a-Service).

“Some of the other issues include standards, regulatory compliance, data ownership, multiple tenants, and data privacy, he added.

On the side of the government, Ibrahim noted that the many benefits the cloud brings push the public sector to take a look at the technology. “But personally speaking, I say these security issues may drive and define how we adopt cloud computing in the future,” he quipped.

The ‘Dark Side’ of the Cloud
Even if all clouds have a silver lining—as the saying goes—Kaspersky Lab believes cloud technology has an inevitable ‘dark side’. “[In cloud computing], everything is happening behind closed doors,” explained Magnus Kalkuhl, senior virus analyst, global research and analyst team, Kaspersky Lab Germany. “And there are no guarantees that services cannot easily be copied. What if the hosting systems were hacked? What if the Internet fails?”

Furthermore, according to an independent study on cloud computing, security remains the topmost concern of users at 64%, followed by administration (58%) and control/vendor lock-in (40%). “Major providers are arguably more secure,” suggested Calen Legaspi, associate analyst, enterprise architect and technology services, XMG Global, “because they have invested much more than normal companies for security.”

When dealing with small cloud providers, Legaspi advised users to do due diligence. “Check with the Cloud Security Alliance if they offer secure services,” he stressed.

Additionally, according to Kalkuhl, negotiating the contract properly can bode well for adopters. “Make sure you keep the freedom to switch,” he said, adding that being prepared for system failures—as in any other technology—can help abate future problems.

It’s All in the Mind
But for Amado Malacaman, vice president of ISSSP (Information Systems Security Society of the Philippines, the real issue is not security. “During the early days, concerns of companies evolved from malfunctions of machines, to risks from internal staff, to external hacks,” he explained. “Cloud computing addresses all of this.”

Malacaman said the real issue concerning the cloud is perception. “Because of the technology change, a new set of standards should be put in place,” he went on, “so training and retraining becomes necessary, while new business models pose new concerns for users.”

More importantly, users—especially the government—need to determine the relevance of cloud computing to their respective organizations, he suggested. “Cloud computing is a new area we should seriously approach. It’s an opportunity for government to leapfrog our neighbors,” he added.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Anuradha Shukla
MIS Asia
April 21, 2010

SHENZHEN, CHINA - Use of the Internet is increasing all across the world and so are the threats that attack unsuspecting PC users. Symantec, a global provider of security, storage, and systems management solutions, has released a report that indicates the continuous evolution of the Internet threats.

According to Symantec, emerging countries are continuously being affected by malicious activities and attacks are increasing due to easy availability of malicious code kits. The situation is further aggravated by the online underground economy and downturn in the global economy.

Activity in emerging countries

The trend of increasing threat in emerging countries became more pronounced in 2009 and now India accounts for 15 per cent of all malicious activity in the Asia Pacific/Japan (APJ) region.

Researchers have realised that countries undergoing rapid growth in broadband infrastructure and connectivity are more susceptible to malicious activity. Perhaps this is the reason why the level of malicious activity in India has been slowly increasing year by year.

Although there were several attacks in the last 12 months, Hydraq trojan (a.k.a., Aurora) on 7 January 2010 has a special mention in the report. This trojan is infamous for harming dozens of large companies and serves as a warning to those who were fortunate enough to remain unscathed by this danger.

Financial motivation

The Symantec State of Enterprise Security report 2010 shows that 75 per cent of enterprises surveyed had to overcome the challenges associated with cyber attacks in 2009. This indicates that enterprises of all sizes are at risk of being attacked by cyber criminals and they should take certain measures to address this.

It is true that attackers are relocating malicious activities to emerging countries but these attacks can still be directed at targets anywhere worldwide. Financial motivation is the main reason behind these attacks.

Apparently, there is money in phishing because several cyber criminals have shifted their efforts towards creating kits, which they can sell to those still new in the underground economy.

If companies don’t take adequate measures, they will suffer because Symantec expects the attacks against Web browsers and malicious code variants installed through these attacks to increase in future.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Michael Malakata
Computerworld Zambia
April 14, 2010

LUSAKA, ZAMBIA - An increase in Web bookings for accommodations and tickets for the World Cup in South Africa has spurred local online users to warn about an uptick in cybercrime in the region.

Africa is currently facing an increase in phishing attacks in which criminals try to extract bank account information in order to steal money from unsuspecting bank customers. Meanwhile, South Africa is hosting the World Cup from June to July this year, with millions of people already making online bookings for tickets and accommodations.

South Africa is Africa’s second-largest telecom market in terms of investment and subscription while Nigeria, Africa’s largest telecom market, is ranked number three in the world in terms of cybercrime. Cybercrime in the region has further increased following the landing last year of Seacom and Teams international cables, which are starting to lower bandwidth and Internet connectivity costs.

Africa is experiencing an explosion of mobile money services as banks and mobile providers compete with customers who would otherwise not have a bank account. This has increased phishing attacks on unsuspecting customers, in efforts to lure them to fake sites and get their bank details.

The problem has been heightened by the fact that very few African countries have a legal framework for cybercrime prevention, or the skills, equipment and organizational abilities to fight cybercrime. Zambia, for example, has a computer misuse law that calls for convicted hackers to be sentenced to jail for up to 25 years, but the country has no equipment and organizational infrastructure to fight cybercrime.

“The problem is that so many people are competing for tickets to the World Cup. In the process, many of them are getting swindled through phishing and fake online promotions for tickets to the event,” said Walter Tapfumanei, communication officer, Africa Agency for ICT Development.

Scammers are also using SMSes to impersonate big company officials and send messages to potential victims saying that they have won tickets to the FIFA 2010 World Cup. In other e-mail, the contact would claim to have been awarded a huge mining contract and would invite the “investor” to the country where they would meet with fake government officials.

Symantec Africa Regional Director Gordon Love said South Africa is experiencing an increase in spam and many other cybercriminal activities including government Web site defacements. As a result of increasing phishing and many other cybercrime activities in South Africa before the World Cup, Symantec has launched a special Web site where it will keep Internet users updated with related attacks and how to access and buy genuine World Cup tickets.

In its monthly report last month, Symantec cautioned Internet users to avoid clicking on suspicious links in e-mails or instant messages and never to fill out forms in messages that ask for personal or financial information or passwords.

Very few banks in Africa that provide Internet services are able to also offer security software to curb cyber-attacks. Phishing attacks aimed at bank customers feature unsolicited messages instructing users to follow a link to confirm their account information, as a way for criminals to obtain passwords and user identities.

“The Zambia police have formed a cybersecurity team in order to crack down on those involved in cybercrimes,” said Ngabo Nankonde, Zambia Information and Communication Technology Authority’s public relations manager. “Once arrested, the penalty is ZMK 36 million (US$8,000) or jail sentence of more than 10 years.”

Generally, ignorance has been cited as the reason many people fall prey to online scams. So far, more than 100 sites selling fake tickets have been shut down by FIFA and South African authorities in a bid to stop the selling of fake World Cup tickets.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Computerworld Philippines Staff
April 12, 2010
 
A new study conducted by IT security firm Sophos, showed that controversial changes Facebook is planning to make to its privacy policy are being universally slammed by users.

The study, conducted among 680 readers on Sophos’s website and Facebook page, found that 95% of the respondents think the privacy changes are “a bad thing.”

Only 2% of the respondents polled said they would support the change, with the remaining 3% saying they did not understand what changes Facebook was proposing.

Only last March, Facebook proposed a number of controversial changes to its privacy policy, paving the way for it to share personal information with “pre-approved” third-party websites. This means that, if you’re logged into Facebook and then visit a third party website, that site will be able to access the following: your name, profile picture, gender, your friends and connections, your user ID, and any content shared using the “Everyone” privacy setting.

This is why users may find that when they visit a website, it already knows who they are – their date of birth; where they live; and who their friends are – all, without ever having given the site explicit permission to access that data. According to Facebook, only a small number of pre-approved sites will be offered this feature, and users will be given the option to disable the feature.

As a result of a rise in public dismay around these changes, Facebook published a response which sought to justify its position and to reassure users that the company would only offer personal data to “carefully selected partners”. It also outlines that partners would be “required to provide an easy and prominent method” for users to opt out directly from their websites and delete any cached personal data.

Graham Cluley, senior technology consultant at Sophos, said the study results send out a very clear message to Facebook – “its users aren’t happy.” He said for instance that most Facebook users still don’t know how to set their Facebook privacy options safely, finding the whole system confusing and long-winded.

“The onus should not be on Facebook users to ‘opt out’ of this new feature but to ‘opt in’ – making a conscious choice to engage, rather than having to make a conscious decision to decline,” Cluley said.

Cluley commented that once again, it feels like online privacy is being eroded by stealth. Too many websites are chipping away at their members’ privacy and security, potentially exposing their personal data to third parties that were never in the equation when they first signed-up for the service.

“Facebook would be doing its hundreds of millions of users a service if it thought again about this new privacy policy,” he said. – Tom S. Noda

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Robert McMillan
IDG News Service (San Francisco Bureau)
April 7, 2010

SAN FRANCISCO (04/06/2010) - Security researcher Jeremy Conway says he has discovered a way to spread malicious code across PDF documents on a victim’s computer.

The attack leverages a flaw in the way the PDF file format works, adding malicious data to legitimate PDF files that could then be used to attack anyone who opens them.

Conway, a product manager with NitroSecurity, had already developed a technique for injecting the malicious commands into PDFs. But his attack only worked when there was some other malicious program on the system that added the code. That all changed last week, when researcher Didier Stevens showed how a PDF document could be altered to run an executable file on a victim’s computer.

“When I saw Didier’s hack, it was the first time I could do it from completely inside the PDF,” Conway said.

Hackers have known for some time that PDF readers could be manipulated in this way, but Stevens’ attack showed how one reader — Foxit Reader — could launch the executable without even notifying the user. Foxit has now patched this bug, but the underlying flaw in the PDF standard can’t be fixed without changing the PDF standard itself.

“This is an example of powerful functionality relied on by some users that also carries potential risks when used incorrectly,” a spokeswoman for Adobe Systems said via e-mail.

Users who want to turn off the Adobe Reader or Acrobat feature that allows the attack to work can click “Edit > Preferences > Categories > Trust Manager > PDF File Attachments” and then un-check the box that reads “Allow opening of non-PDF file attachments with external applications.”

With version 3.2.1 of Foxit Reader, released Thursday, the software now pops up a dialogue box asking users if they really want to execute the code. Adobe Reader does the same thing.

In a video demo of his attack, Conway shows how he was able to build a malicious PDF document with the executable code that also inserted his own text in Adobe’s warning box. By adding text such as “click ‘Open’ to unencrypt this file,” an attacker can increase his chances of getting a victim to open the file.

If a user falls for the trick and allows the executable to run, Conway’s attack then acts like a worm, copying a malicious payload to other PDF files on the computer. This malware can be a known PDF attack or something worse. It “could be the next vector for a 0day attack,” Conway said.

He believes most enterprises are unprepared to deal with this technique, should it be adopted by cybercriminals. “Most responders are not going to go through every document on a user’s computer to make sure it’s safe,” he said.

He has not released the code for his attack, just the video showing it in action.

The PDF attack could be used to do things such as inject malicious macros into Word documents, said Thierry Zoller, a security consultant with Verizon Luxembourg, speaking via instant message. “You could also easily infect anything else,” he said.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Tim Greene
Network World (US)
March 31, 2010

FRAMINGHAM - Researchers led by the Massachusetts Institute of Technology and funded by the Defense Advanced Research Projects Agency have developed software that keeps applications running during attacks, then finds and installs permanent patches to protect them.

The ClearView system detects attacks by noting when applications perform outside their normal range of behavior, indicating an attack of some sort. To fend off attacks, it tries out a variety of patches on the fly, choosing the one that best returns the application to normal.

The researchers are running a feasibility study to determine whether to develop the system into a commercial product, says Martin Rinard, the lead researcher on the project.

What sets ClearView apart from other attack-mitigation schemes is that programs don’t stop running while patches are chosen and put in place, Rinard says, so users of the applications can continue to work.

During testing required by DARPA, ClearView underwent attacks designed by a team from security contractor SPARTA and prevented it from injecting and executing any malicious code in the application, Rinard says.

The system works by running a piece of ClearView monitoring software on host machines that keeps an eye on the application as it runs to define a set of normal behaviors. When ClearView detects that the application is going beyond normal, it chooses and tries out patches from a server-based template library of fixes in an attempt to return the application performance back within normal ranges.

The system scores each patch for how well it works to mitigate the abnormal behavior and chooses the one with the best score. That patch is applied to all instances of the application within the network being protected, a tactic that can prevent any impact to those instances of the target application running on devices that have not yet been attacked.

Researchers ran two phases of the project, the first checking for effects code injection attacks had on general application processes. The second phase focused on monitoring system calls to the operating system, determining a range of normal calls during a learning phase, and seeking suspicious calls that fell outside normal.

For the purposes of the test, the researchers used Firefox 1.0 as the target application. “It could be any application server or client,” Rinard says, but Firefox 1.0 was fairly complex, readily available and had known security flaws that have been fixed in later versions.

In the first phase, the group used Determina, a commercial intrusion-detection platform owned by VMware to detect code-injection attacks and to add and delete patches. In phase two, the researchers used the open source Pin dynamic instrumentation engine to monitor system calls and insert patches while the application was running.

To analyze how well the patches worked, the researchers used daikon, software developed by Prof. Michael Ernst of University of Washington who worked on the ClearView project. Daikon infers what program properties are necessary to successfully running it and that must be preserved when modifying the code.

In the first phase of the tests, it took minutes to detect and fix the application against attacks. In phase two it took just seconds, primarily because system calls have a well-defined interface that supports more efficient selection and repair strategies, Rinard says.

ClearView code has nothing in it that is specific to any particular application, so it can be used to detect attacks and attempt patches to any application.

In tests of how well the system worked, the attackers were told ahead of time what application they were going to attack. ClearView fixed the application in 70% of the cases in phase one, and in 92% of the cases in phase two, Rinard says.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Anuradha Shukla
MIS Asia
March 26, 2010

SINGAPORE - Cisco introduced the CCIE certification in 1993 to aid the industry in distinguishing the top inter-networking experts worldwide.

Fifteen years later, the company has announced the results of a comprehensive end-customer survey conducted by the international CCIE community. Through this survey, Cisco is trying to gain insight into what digital infrastructures will look like over the next five years.

Perspective of IT professionals

This research was conducted by a strategic research firm Illuminas, and commissioned as part of Cisco’s overall 25th anniversary celebration. The survey was designed in a manner to know the unique perspective of some of the most knowledgeable information technology professionals in the networking industry.

According to Cisco, there are several factors that are driving innovation such as virtualisation, security and risk management, unified communications, video, and real-time collaboration.

The majority (two-thirds) of the CCIE holders surveyed expect virtualisation to be the top networking investment over the next five years. Virtualisation is seen as an energy-, space- and cost-saving measure and the respondents believe that a holistic and comprehensive virtualisation strategy can increase operational efficiency and simplify management.

Avoid security breaches

Cisco emphasises the importance of networking professionals to stay ahead of the increasing number of internal and external security breaches. About 64 per cent of respondents said security and risk management will be the networking skills in greatest demand in the coming three to five years.

About fifty per cent expect more companies to adopt unified communications leading to increased collaboration in the workforce. Thirty per cent of those surveyed expect that over the next five years, CIOs will especially focus on accommodating the needs of a highly collaborative, global workforce.

Real-time video solutions such as Cisco TelePresence will be one of the top green initiatives affecting networks and network engineers, according to 52 per cent of the respondents.

“CCIE holders have established a reputation for leading the networking industry in deep technical networking knowledge and are typically deployed into the most technically challenging network assignments,” said Jeanne Beliveau-Dunn, general manager, Learning@Cisco. “As a result, they have an unparalleled depth of knowledge and experience.”

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

IT professionals possessing skills in security and virtualization will be in demand this year, according to most of the 75 CIOs Computerworld Philippines surveyed by phone in January. Wireless and programming skills—especially knowledge in Java and Visual Basic—will also be hot skills this year. Meanwhile, certification in the skills needed by companies this year will not be important, says 59% of the respondents. For non-technology skills, 56% of the CIOs say they prefer hiring IT professionals that are proficient in verbal and written communications.

The five areas which your company will be needing skills for in 2010?

Security 81%
Virtualization 44
Wired/Wireless Infrastructure 44
Programming 40
Business Intelligence 40
Sofware as a Service (SaaS)/Cloud Computing 32
Business Process Management 31
Open Source 29
Information Technology Infrastructure Library (ITIL) 29
Customer Relationship Management (CRM) 27
Enterprise Resource Planning (ERP) 21
Web 2.0 17
Legacy Skills (Mainframes, COBOL, etc.) 7
Others
Warehouse Management Systems/Concepts 1
XFS and XML Conversion Messaging Specialization 1
Work Flows 1
Technical Writing 1
Total Cost Ownership 1
Software for Accounting Systems 1

Programming Language To Be Used
Java 33%
Visual Basic 20
.Net 20
ABAP.Net 7
Web-based 7
C# 7
Oracle 7
VB.Net 7
SAP.ABAP 3
AS/400 RPG 3
Progress 3
SQL 3
PHP 3
ASP.Net 3
Database 3

Will you be needing certified professionals for the skills you need?
Yes 37%
No 59
Only in Business Intelligence 1
Only in Virtualization 1
Only in Security 2

What non-technology skills will you be requiring in 2010?
Verbal and written communication skills 56%
Business savvy 47
Interpersonal skills 53
Others
Quality & Continuous Improvement 1
Leadership skills 1
No requirements 5

Possibly Related Posts:

• Untangling Network Difficulties
• Unifying Communications
• CFO: IT’s New Boss?
• More Work, Low Pay
• BPO workers too stressed out, ILO study finds