Verimatrix Invited to Speak at Industry Conferences to Share Content Security Expertise
11188
Verimatrix:  WHO:       Verimatrix enhances the value and security of pay-TV networks with advanced technologies designed to address the content protection challenges of today, and those of tomorrow.
639121
(InfoWorld) - Enterprise security decision makers have long been more likely to be swayed by flashy new technologies than by the notion of comprehensive IT restructuring to protect data and other corporate assets, but the situation is evolving rapidly, according to experts participating in Forrester Research's ongoing Security Forum. Kicking off in Atlanta on Sept. 5, the two-day event will bring together a number of influential IT security consultants and researchers along with a range of vendors and end-users to debate pressing issues impacting enterprise businesses today. Whereas such technology meetings, including Forrester's inaugural 2006 security confab, have historically focused more on the acquisition of new technologies or the latest trends in malware, companies are finally beginning to spend less time on investigating individual attacks and defense mechanisms and more closely examining the idea of broad-ranging risk management, show organizers said. "There isn't any hot new technology being pitched at us these days. The process is less about shiny widgets than it is about cohesive programs that combine security and risk management," said Laura Koetzle, the Forrester analyst charged with pulling the event together. "For a long time, the power in the security industry has been in the hands of the technology providers," she said. "But as enterprise security programs are maturing, we're seeing a shift to more coherent strategies that emphasizes specific business needs." Koetzle said that the annual conference will have its fair share of security research reports on emerging threats -- including the latest on messaging security trends from specialists with Postini -- but the analyst highlighted increasing sophistication of the planned discussions, which focus on how companies can work with their customers and business partners to take a more organic approach to security. "Many people growing up in the security discipline have seen a lot over the last few years, and now they're focused on working with business partners both inside and outside of their firms to get a more holistic view of what they want to accomplish, versus blocking viruses and filtering," said Koetzle. "Today, security folks are much less likely to be a guy in a black hat in charge of some esoteric technology whom you never see, it's more about people who coordinate management strategy for companies and ensure that they have the right skills and partners in place," she said. The Forrester analyst contends that security professionals are also no longer forced to fight for attention among the ranks of IT with c-level corporate leaders having woken up to the fact that their companies' operations and reputations can be severely affected by data breaches and security gaffes. Among the scheduled speakers at the show will be representatives from IT vendors including Dell, Texas Instruments, and VeriSign, but Forester has also corralled customers from the financial services and healthcare industries to share their latest experiences. Along with a slew of Forrester's own experts, academic researchers from Johns Hopkins University and Purdue University are also slated to speak at the show. Representing Johns Hopkins will be Dr. Aviel Rubin, director of the school's Information Security Institute and a well-known expert regarding e-voting technologies and many of the issues that loom with the continued adoption of the systems. Rubin, who will also be representing his Baltimore-based consulting firm, Independent Security Evaluators, said that he will explain to show attendees how many existing IT products can still be broken by sophisticated hackers. "It will always be a fact of life that things can be broken and not always by the good guys who will publicize it, so it's important that people examine the way they handle incidents, and it's always good to encourage people to share their stories," Rubin said. However, the researcher said he will also focus on the process improvements that many companies have been able to appreciate as their security efforts have matured. "With the experience they've accrued, some companies, including vendors, are doing a better job of handling vulnerabilities and reporting," he said. "However, it's still useful to look at how things can still be circumvented and look at the measures that are being put in place to stop that sort of activity." Also presenting will be Brian Contos, chief security officer at security management specialists ArcSight and the author of the well-known insider threat tome Enemy at the Water Cooler. Contos agreed that the political battles that IT security pros needed to fight just to get attention and budget from business leaders have waned over the last several years and said that companies are getting far more aggressive in how they police their users and networks. However, that shift has also created new challenges, he said. "People want to monitor almost everything, but by adding more events, they are moving from megabytes of result information to terabytes and also trying to meld IT security efforts with physical security, which will be a long process," Contos said. "The main question we're hearing has become how companies can deal with this flood of data and turn it into something valuable, that's the challenge that many of these enterprise customers face going forward."
94786
Computer security pros descend on Washington, D.C., confab to talk risks, hacks and digital self-defense.
275045
Credit-card payments giant Visa is hoping to shed new light on problems like consumer data theft and identity fraud through a conference that will bring together leaders from the business, government, and technology communities to discuss security for the electronic payments industry.
272204
Programmers, entrepreneurs, students and lawyers gather in mid-town Manhattan for an ad hoc conference on the latest web trends. Participation is required and shoes are not allowed. David Cohn reports from New York City.
65869
If a concerted cyberattack is coupled with a physical attack, will the system hold up? VeriSign CEO Stratton Sclavos talks about what's being done to prepare.
359707
Rigorous disclosure of network vulnerabilities will all be part of the action at next week's back-to-back hackfests in Las Vegas.
742212
CANNES - Despite the number of IT security products and services cramming the market, businesses are more exposed than ever to emerging threats, according to industry experts speaking at the Etre technology conference in Cannes on Tuesday.
440113
Pharmacopeia presents at an investors' conference.
29663
Company has started sharing some APIs with security vendors, in a bid to create better ways of securing virtual machines.
463385
(InfoWorld) - Secure card maker HID Corp. is objecting to a demonstration of a hacking tool at this week's Black Hat Federal security conference in Washington, D.C. that could make it easy to clone a wide range of so-called "proximity" door access cards. HID has sent a letter to IOActive, a security consulting firm, accusing Chris Paget, IOActive's director of research and development, of possible patent infringement over a planned presentation, "RFID for beginners," on Wednesday, a move that could lead to legal action should the talk go forward, according to Jeff Moss, founder and director of Black Hat. IOActive will hold a press conference Tuesday at 9:00AM to discuss the issue, according to Joshua Pennell, IOActive's CEO told InfoWorld. Paget's talk will address widespread security issues with the implementation of RFID in proximity cards that are sold by HID and other companies and that are widely used for building access. His RFID cloner was on display at the recent RSA Security Conference in San Francisco, where he demonstrated for InfoWorld how the device could be used to steal access codes from HID brand proximity cards, store them, then use the stolen codes to fool a HID card reader. Paget's presentation at Black Hat Federal will go deeper, providing schematics and source code that attendees could use to create their own cloning device, and discussing vulnerable implementations of RFID technology in a wide variety of devices, Paget told InfoWorld at RSA earlier this month. "Hopefully I'll be able to give people some information about RFID and get some pressure on vendors to fix these lousy RFID implementations," Paget said. "As it stands, I can walk up to someone on the street or maybe stand next to them in an elevator, grab their card ID and get into the building," he said. So far, Black Hat organizers have not been contacted or asked to cancel Paget's presentation, but lawyers representing Black Hat, which was purchased by CMP, are ready should that happen, Moss said. "We're prepared for the worst," Moss said. The incident between HID and IOActive recalls a 2005 imbroglio between researcher Michael Lynn and Cisco Systems over a presentation of a flaw in Cisco's IOS at a Black Hat event in Las Vegas. In that incident, Cisco attorneys demanded that Lynn's presentation be torn out of the printed conference proceedings and that Lynn be blocked from giving his talk. Lynn ultimately resigned his position at Internet Security Systems Inc. (ISS) and gave the talk anyway, spawning lawsuits and even an FBI investigation of him. Lynn now works as a researcher at Cisco competitor, Juniper Networks. Whereas Lynn's hack of IOS was considered novel, however, the IOActive demonstration of RFID vulnerabilities is largely a rehash of known issues, intended more as an introduction, Moss said. "They've known about this for years and years," Moss said. Kathleen Carroll, a spokeswoman for HID's Government Relations group acknowledged that a letter was sent to IOActive but that it did not mention patent infringement. She said that the company has long been aware that its proximity cards are vulnerable to hacking but does not believe that the cards are as vulnerable as Paget suggests. "For someone to be able to surreptitiously read a card, they'd have to get within two or three inches and get into the same plane as the card," Carroll said. HID is also concerned that Paget's demonstration will popularize the vulnerabilities in its proximity cards and endanger its many customers. "These systems are installed all over the place. It's not just HID, but lots of companies, and there hasn't been a problem. Now we've got a person who's saying let's get publicity for our company and show everyone how to do it, and it puts everyone at risk. Where's the sense of responsibility?" Carroll said. According to Moss, HID has charged Paget with patent infringement over his presentation, but has not laid out any particular remedies or threatened actions, making it difficult to ascertain what the company might do -- if anything -- to block the presentation. Security problems with implementations of RFID are well known and have been publicized before. In 2005, security consultant Jonathan Westhues detailed attacks against implanted VeriChip RFID chips. More recently, in January, Westhues posted detailed code and schematics for an RFID hacking device that can act as a reader, eavesdrop on RFID transactions between reader and a tag, analyze the signal received over the air, or impersonate a tag.Â  In 2005, Avi Rubin and other researchers at Johns Hopkins also sounded the alarm about weak security in RFID implementations by hacking technology from Texas Instruments that is used in late model car ignition systems and electronic payment systems, as well. All that attention hasn't sparked much change at companies like HID, which makes fifteen different types of proximity cards in their Prox Products and Indala Prox Products lines, all of which are believed to be vulnerable to cloning, according to Paget. "Some of these cards have been around for 15 years and were developed when there was no awareness of the problem," Carroll said. Asked why HID hasn't addressed the issue in more recent proximity card systems, after knowledge of RFID threats became common, Carroll said that doing so would cause "major upheaval" among customers.Â  Inertia is a more likely cause, said Dan Kaminsky, director of penetration testing at IOActive. "They didn't want to change to a more secure implementation because of backwards compatibility issues, and they had a lot of sites that use these cards, and HID has stuff to sell them," Kaminsky said. Paget's hack was no feat of engineering wizardry, Kaminsky said. "It took a month -- and he wasn't even working on it full time." The problem is that RFID technology, although good for inventory tracking as a replacement for barcodes, is not well suited for security, Kaminsky said. "The technology is very convenient, but don't interpret the convenience as security," Kaminsky said. "At the end of the day, many companies are essentially using barcode technology to control access to their facilities. I'd posit that perhaps there are more secure technologies out there." HID recommends that customers who are concerned about cloning upgrade to one of HID's smart card products, which do encrypt transmissions between card and reader and are more difficult to hack, Carroll said. HID also recommends that companies that use the cards train their employees to look for suspicious activity that might indicate that someone is trying to clone or spoof access cards. As for Paget's presentation, Moss expressed frustration over HID's actions, especially given the widespread attention to RFID security holes. "It's just so frustrating from a security standpoint. Now anytime someone wants to talk about anything, they need a team of lawyers. Even when it's about commonly understood problems," Moss said. For now, Moss said Black Hat is supporting Paget and his presentation -- even if last minute changes are needed to satisfy HID, Moss said.
280879
The official speakers list has been posted for this year's Zend/PHP Conference & Expo happening in October at the Hyatt Regency San Francisco.   Included in the list for this year's conference are talks like:   Optimizing Service Oriented Architectures with PHP  - Glen Campbell The Internet is an Ogre: Finding Art in the Software Architecture - Terry Chay Implementing Access Control with Zend Framework - Darby Felton Give Your Site A Boost With Memcached - Ben Ramsey PHP Diversity - PHP applications in a Heterogeneous IT Environment - Joe Stagner PHP::$unicode->i18n() - Andrei Zmievski   Check out the full speaker's list here and the main conference site for details on pricing, lodging and all other conference-related information.
604601
VeriSign Inc. officials are launching a managed security service that they believe can cut up to 40 percent of the cost of deploying strong authentication throughout an enterprise.
62123
(InfoWorld) - Cisco executives speaking at the ongoing Security Standard Conference claim that the networking giant hasn't sapped innovation in the security companies it has acquired in its efforts to add to its own expanse of IT systems-defense products, while some customers clearly feel otherwise. Taking the stage at the conference in Chicago on Monday to participate in a panel on Cisco's vision for warding off emerging threats and spam, the company's top security executives, and former IronPort Chief Executive Scott Weiss, defended the firm's growth-via-acquisition strategy. Cisco finalized its $830 million buyout of IronPort in June -- only the latest in a long string of such security acquisitions. The company has already begun blending the messaging and malware filtering gateway specialist's technologies into its firewalls, which the executives claim has created a new capability to provide customers with "wide packet inspection," an approach that adds reputation-based anti-attack capabilities to the systems' existing virus and spam detection abilities. Such integration work illustrates the fact that Cisco is improving the ability of its customers to defend their networks from attack and that the firm is serious about innovation and not just attempting to grow its revenues or boost sales of its networking gear by snapping-up other security vendors, Weiss told the assembled audience. Asked by a conference attendee whether major platform providers like Cisco, Microsoft, and IBM will continue to swallow smaller security companies, along with industry giants like Symantec, and how that will impact the availability of the cutting-edge technologies often developed by independent vendors, Weiss said that more consolidation is likely inevitable. Yet he also acknowledged that some niche players will continue to do well on their own. "All the [venture capital] firms that are into small security companies will likely make out like bandits, and there will be a scrum to get the good stuff," said Weiss, who is still heading up IronPort inside Cisco. "Bigger companies will have to decide whether to build, buy, or partner." Weiss highlighted Webroot, the anti-spyware software company that industry watchers have long tabbed for acquisition based on its specialized focus -- and which continues to defy those predictions and grow on its own -- as an example of the type of vendor that will be able to compete in a world where security is being driven further into other broadly-distributed IT platforms, such as Cisco's ubiquitous networking gear. "I think we'll continue to see new Webroots pop-up that can help deal with new threats," he said. "The issue for these companies is how broad is their platform and how to carve a significant portion of the infrastructure out; they have to ask themselves if their technology is broad enough to support a large, profitable company." Along with the benefits of melding together complimentary technologies, such as gateway filtering tools and firewalls, Weiss claims that customers are seeking integrated technologies from single vendors and increasingly looking for "one throat to choke" when selecting security tools. "Users of these technologies want products that talk to each other and have collaborative interfaces," he said. Customers worry about consolidation However, some existing Cisco customers claim that they are troubled by the continued pace of security industry consolidation. Even if Cisco can add many of the pieces that customers seek, it will likely not be able to provide technologies that are as innovative and effective as those made by independent vendors in some areas, said Waqas Akkawi, senior manager of IT security at Sirva, the moving giant that owns Allied Van Lines, Global Van Lines, and North American Van Lines, among other subsidiaries. Akkawi said that Cisco excels in some areas of security where it has experience, namely in network-based tools, but he noted that even some of those products, such as its IDS (intrusion detection systems) and IPS (intrusion prevention systems), also added via various acquisitions, don't measure up to those made by standalone providers. "Cisco is good at what they do naturally, as with firewalls, routers and switches, but they haven't done a good job on things like IPS and IDS where some other niche companies do a better job," said Akkawi. "In a lot of cases I think customers would be better off if these types of companies partnered instead of doing acquisitions or trying to build functionality into their existing products on their own. Sometimes a niche product that integrates well is going to be better than what these guys are talking about." Akkawi, who is a Cisco-certified IT pro, said that Sirva is constantly considering whether or not to go best-of-breed with independent vendors or buy into integrated security products like those being integrated by platform providers like Cisco's IronPort buyout. "These acquisitions will only work if a platform provider like Cisco can build the acquired technology into things they already do well. In some cases, these types of companies haven't been able to integrate everything they've bought, and we've seen some best-of-breed products go away," he said. "[Sirva] will likely continue to go fifty-fifty in terms of the integrated products we choose to buy, and the others we seek out to get true best-of-breed functionality." Many IT platform providers have moved aggressively in recent years to add security to their portfolios where it fits, as with EMC's buyout of authentication specialists RSA, along with IBM and HP's recent moves to add applications testing capabilities to their software development platforms via acquisition. The nature of the security industry is such that certain functions will be parceled into such widely-used technologies, while other newer tools will likely emerge from independents, said Mick Scully, vice president of product management at Cisco's Security Technology Group. Scully countered that despite any perception of cutting at innovation, Cisco is creating many new technology combinations that customers have responded well to, allowing its overall security business to crest $2 billion in revenues in the firm's fiscal 2006, representing a 25 percent annual growth rate in its overall security business. "There will always be a balance between best-of-breed and integrated security. The beauty of the market is that it is constantly changing at a rapid pace, and we will always see startups who address specific problems," Scully said. "But if you look at an acquisition like IronPort, we've left it almost entirely intact, run by the same team, even as we push its technologies into other products." Scully also highlighted the fact that Cisco has proven its chops as a security innovator, such as in creating the burgeoning market for NAC device authentication systems. He said that Cisco itself views its acquisitions as fifty-fifty propositions, looking for as many opportunities to continue to innovate the technologies its buys as it seeks opportunities to fold them into its other product lines. "It's an interesting dichotomy, I sort of see what these customers are saying, but we also believe that our standalone products, such as our NAC appliances, are already best-of-breed," Scully said. "As niche security markets become mature, merchant markets, we are going to look to get into those markets where we fit in; but we're also doing a lot of organic product development on our own, and we feel that we can offer best-of-breed capabilities in the security markets we compete in."
570924
The companies plan to share security features to help customers protect their networks from worms and viruses.
743118
(Source: MessageLabs)Administrators struggle with ever increasing complexity in the data center. Join Brian Babineau, Enterprise Strategy Group and Anne O'Neill, Symantec Corporation for an evaluation of these options and the discussion of Veritas Server Foundation from Symantec, a novel approach to Data Center Automation that embodies Symantec's vision for a solution to DCA that is both complete and simple. We invite you to register now for full access to this online broadcast.
583540
(InfoWorld) - A planned talk on RFID security by a security researcher has been pulled from this week's Black Hat Federal security conference after secure card maker HID claimed the talk violated the company's patent rights and threatened to take legal action against Chris Paget, the researcher, and IOActive, Paget's employer, if the talk went forward. The company decided to cancel the talk after all-night negotiations with HID collapsed, said Josh Pennell, CEO of IOActive. In response, Black Hat organizers were forced to tear materials out of printed show proceedings and will instead present a discussion by a representative of the ACLU on the criticality of RFID security, said Jeff Moss, founder and director of Black Hat. A spokeswoman for HID did not immediately respond to a request for comment. The incident recalled a 2005 dispute over a presentation at Black Hat in Las Vegas involving Cisco Systems and Michael Lynn, a security researcher who worked for Internet Security Systems at the time. IOActive's decision to abort their presentation follows days of tense negotiations between the two companies, after HID became alarmed about Paget's discussion, "RFID for beginners," which was to address widespread security issues with the implementation of RFID in proximity cards that are sold by HID and other companies. Paget's RFID cloning device was on display at the recent RSA Security Conference in San Francisco, where he demonstrated for InfoWorld how the device could be used to steal access codes from HID brand proximity cards, store them, then use the stolen codes to fool a HID card reader. Paget's presentation at Black Hat Federal would have includedÂ  schematics and source code that attendees could use to create their own cloning device, and a discussion of vulnerable implementations of RFID technology in a wide variety of devices, Paget told InfoWorld at RSA earlier this month. HID claimed that Paget's talk would infringe upon two patents the company owns, one dating to 1991 and another dating to 1992. Both cover methods of detecting RFID signals between a transponder embedded in a device and an "interrogator," according to a source familiar with HID's claims. Pennell and others doubted that such broad patent claims could be used to stifle free speech, but said that the legal pressure mounted by HID, a subsidiary of Swedish firm ASSA ABLOY, was too much for his small, Seattle-based consulting firm to withstand. "If we say anything, HID will sue. These large companies have lots of resources, so they can find [legal] matter with pretty much anything," Pennell said, admitting disappointment at the failure to reach an agreement with HID. "It's always been IOActive's intent to help people with security," he said. Chris Paget said that, unlike Lynn's sophisticated hack of Cisco's IOS operating system, the RFID cloning devices he built were simple devices concocted from around $20 in off-the-shelf parts purchased on eBay. "This thing is simpler than a Furbie," he said, referring to the plush electronic play toy of years past. Moreover, the HID patents in question are public documents, containing all the information needed to build the RFID cloner, he said. "This is not something new that we're doing. HID has known about this for about two years, if not longer," Paget said. Indeed, HID marketing materials for its Smart Card technology notes that "by using diversified unique keys and industry standard encryption techniques, the risk of compromised data or duplicated (smart) cards is reduced," and that "these security measures are not implemented in proximity cards, giving contactless smart cards a significant security advantage." While it's possible to make secure RFID devices that can store sensitive information, the HID proximity cards that use it are not secure, and customers who use the cards need to know that, Paget said. "Our intent was to disseminate information so people could make informed decisions about RFID technology they're deploying. For example, whether to deploy a proximity card with a secondary factor like a biometric or PIN [personal ID number]. But we've been prevented by HID from discussing that, and we believe it's detrimental to the security community," he said.Â  Nicole Ozer, technology & civil liberties policy director at the ACLU of Northern California, said that the work IOActive was doing was vital and that, while the group supports the enforcement of patent law, "free speech must be protected and not "trampled by the overzealous use of patent law." Government agencies, including the Government Accountability Office and the Department of Homeland Security, have all raised concerns about RFID security, even as they issue guidelines for using RFID in passports and other documents, she said. "It's particularly important that the government and the public have all the information on RFID technology. The use of RFID without the proper protections could jeopardize privacy, security, and public safety," she said. For Moss and Black Hat, which is now part of CMP, the decision by IOActive to cancel Paget's talk was a discouraging reprise of the controversy two years ago over Michael Lynn's talk in Las Vegas. Show organizers, once again ripping pages out of conference proceedings at the request of IOActive, and recalling CDs containing copies of Paget's presentation. "We're supporting IOActive," Moss said, noting that CMP had its legal team working on behalf of IOActive to see if a solution could be reached. "I'm not sure if it was part of HID's strategy to drop a bomb at the last minute, but it really screwed up our conference strategy," he said.