Tech CEOs Issue Cyber-Security Recommendations
95022
A group representing technology industry chief executives on Tuesday warned that the Bush administration has failed to follow through on its two-year-old strategy for protecting the nation&#39;s
364615
A group representing the cybersecurity industry has called for the White House to show &quot;greater leadership&quot; in guarding the nation&#39;s computer infrastructure from attacks by hackers and viruses
247065
Microsoft&#39;s chief executive believes it&#39;s naive to suggest the software giant can eliminate all security vulnerabilities in its various
354657
For the executives being honored at Computerworld&#8217;s Premier 100 IT Leaders Conference, crises and other career-defining moments pose challenges but also create leadership opportunities.
302175
com September 10, 2004, 1:42 PM PT. Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
402450
(InfoWorld) - As director of research at the SANS Institute, Alan Paller has a unique window from which to view the U.S. governmentâs efforts to secure its vast computer networks. An original member of the National Infrastructure Advisory Council, Paller has had the ear of high-level White House officials.Â  Paller has also been a reliable critic of the governmentâs cybersecurity plans, which he says are ineffective and mired in bureaucracy. Last week, Paller was at it again, joining Eric Byres, Director of Industrial Cyber Security at Symantec to talk about cyberattacks on SCADA (supervisory control and data acquisition) systems that manage the nationâs critical infrastructure. Ahead of that event, Paller told InfoWorld Senior Editor Paul Roberts that SCADA hacks have already happened and that on the five-year anniversary of the Sept. 11, 2001, terrorist attacks, the U.S. gets an âFâÂ  for protecting its computers from hackers, terrorist or otherwise. InfoWorld: Weâve been hearing about the threat of terrorist cyberattacks for years. Is the threat for real? Alan Paller: It is a real threat, but itâs an interesting threat. What you have happening today is that terrorists are using cybercrime to get the money to buy the bombs to blow people up. But theyâre not using cyberattacks against physical things. There have been two cases that are very secret where SCADA systems that run power plants were taken over, but the crime was about extortion -- you know, âIf you donât pay us weâre going to do something bad.âÂ  In some cases the guys have proven that they can do damage by running a test denial of service attack, or a test outage. IW: Conventional wisdom was that SCADA systems are too old and idiosyncratic to be easy targets. What has changed? AP: The difference is that companies have added Windows systems to replace unknown operating systems, and then connected them to their networks, which are connected to the Internet. GAO did a great report on this back in 2004. Most of the attacks we hear about arenât aimed at SCADA systems, theyâre aimed at corporate networks, but once youâre on the network you can get into these (SCADA) systems. IW: Why should enterprise IT people care about the security of SCADA systems? AP: The big shock to us was all the places where control systems are used. NIST [National Institute of Standards and Technology] did a study that found SCADA systems were common in the electric, water, oil and gas, chemical, pharmaceutical, pulp and paper, food and beverage, discrete manufacturing, durable goods, air and rail transportation, mining and metallurgy industries. So tell me whatâs not covered there. Almost anyone who works in a major industry has this stuff on their plate.Â  IW: Is there any evidence that foreign governments are privy to information on how to attack SCADA systems in the U.S.? AP: Well, you have the statement Gen. Lord gave that the military has lost terabytes of sensitive information to the Chinese government. [Editorâs Note: Maj. Gen. William Lord told GCN in August that âChina has downloaded 10 to 20TB of data from NIPRNet, the DoDâs Non-Classified IP Router Network.â] That was the first public âoopsâ that weâve heard. It was an admission at the highest level that weâve spent all this money and systematically the Chinese have been able to come in and steal this information. IW: Recently, an article in Foreign Affairs criticized the U.S. government for playing defense on cybersecurity and missing the way terrorists are using the Internet to organize and raise money. Is that fair? AP: Youâre giving [the government] too much credit for having an active defense. They donât have an active defense. What they have is a lot of reports that have been written. Just one consulting firm increased their staff writing (cybersecurity) reports from four people to 200 in the last five years. As one chief of staff told me, the best thing to do with those reports is to pile them in front of our buildings so the terrorists canât use a car bomb to get us. IW: If you had to give the U.S. government a grade on cybersecurity, what would it be? AP: It would have to be an F. I mean, if you canât secure the boxes that you have, that would have to be an F.
360002
The Department of Homeland Security has named an acting US cybersecurity chief as Congress weighed whether to give the position greater clout to fight hackers, viruses and other online threats.
225079
InfoWorld - In early December, InfoWorld Senior Writer Matt Hines had the opportunity to sit down with John Thompson, chief executive of Symantec, and David DeWalt, chief executive of McAfee, to interview the leaders about the strategic direction of their companies and where they see different aspects of the IT security market heading in 2008 and beyond.
587938
Addressing the issue of global piracy on the Internet, the head of one of the world's largest telcos told no less than Earth's biggest economic summit that some kind of technological solution may be necessary.
404305
(InfoWorld) - Governments and businesses face a variety of cybersecurity threats, but they also need to allow for increasing demands from computer users across the globe, the former information security advisor for the U.K. Ministry of Defense said Wednesday. David Longhurst, who retired this week, called for businesses and governments to take a risk-based approach to cybersecurity by balancing the advantages of new applications and capabilities with the security risks. Too often, Longhurst found himself between the U.K. military, which wanted new networked capabilities, and in-house cybersecurity experts, who wanted no new networking functionality, he said during Microsoft Corp.'s Security Summit East in Washington, D.C. "IT security folks don't want to connect anything," he said. "They believe safe sex is no sex." Longhurst didn't downplay cybersecurity risks as he spoke to a crowd of developers and network security administrators. Protecting the global information infrastructure is one of the top -- if not the top -- challenges for governments, developers and infrastructure providers, he said. It's difficult to fully assess the magnitude of the threat, he said, with IT security experts often saying, "We just have to tell you, it's bad." But as security threats continue to be a large problem, IT users are demanding increased functionality that supports their business, is easy to use, is reliable and safe, and "makes the coffee in the morning," he said. Maybe users don't want their computers to make coffee, but IT security professionals can face demands from users who want to access sensitive data from Internet cafes in Beijing, he said. "They say, 'I'd like to connect to anybody, anywhere, access anything for practically any purpose, at any time,'" Longhurst said. "You could do all this ... if we didn't have a Wild West out there." Longhurst called on everyone in the IT chain, including developers, integrators and users, to give cybersecurity a higher priority. But he also advised companies and government agencies to weigh the risks of new technology with the benefits to themselves or their customers. "This is a risk-based business," he said. "There are no absolutes in this." To fully access risk, businesses and government agencies need to hear from IT security experts, from those wanting the new functionality and from engineers who estimate how long any identified problems will take to fix. In some cases, the U.K. government has rolled out new technology even with security concerns, but set a deadline for fixing any problems, he said. Earlier, George Stathakopoulos, Microsoft's general manager for product security, said the company continues to push security in its upcoming Windows Vista OS. Vista will include several security features, including support for smart-card access to computers, and the Windows Defender scanning tool, he said. Stathakopoulos called on governments and courts to increase penalties against attackers who are caught. "Right now, you write a Sasser [worm] and get a two-year suspended sentence," he said, referring to a 2005 conviction in Germany. "You may even get a security job."
473284
Microsoft Corp.'s chief executive believes it's naive to suggest the software giant can eliminate all security vulnerabilities in its various products even though engineers are trying hard to do so.
483534
A think tank has tapped several heavyweight cybersecurity experts for a commission tasked with giving security recommendations to the next U.S. president.
694927
CEO weighs in on Linux, EU regulators, music pirates and "bad people out there in cyberspace."
577394
Despite having a greater awareness of the security risks posed by careless computing habits and personal Internet activity carried out on corporate laptops, many remote workers continue to do things that imperil the safety of themselves and their employers, according to a new report from Cisco.As part of its annual study on the security awareness and online behavior of remote workers -- based on interviews with 2,000 telecommuters carried out by researchers from InsightExpress -- Cisco experts said that people appear to have acquired a false sense of security when it comes to the use of their company-issued computers and other corporate IT assets.Despite the fact that the IT security community has done a much better job in recent years of keeping people informed of the latest and greatest malware attacks and social engineering schemes, remote workers keep falling for the same types of tricks as they always have -- in part because they believe that they are now protected by more advanced security technologies, said Patrick Gray, special assistant to the CTO at Cisco.In fact, in just one year's time, the number of respondents to the survey who expressed a belief that the Internet is "getting safer" increased from 48 percent 12 months ago to more than 56 percent in 2008. The trend was particularly evident in some parts of the world where Internet use is growing the fastest, and where people believe that their governments are going to greater lengths to protect individual users, such as Brazil (71 percent), India (68 percent), and China (64 percent). In Brazil, for instance, where banking-password stealing Trojan virus attacks have finally been thwarted by stricter legal penalties for those creating the threats, people may falsely assume that it is now safe to let down their guard, according to Gray."The awareness of security threats has grown across the board, but somehow, because of that, we do see the emergence of this false sense of security," said Gray. "Companies have done a great job of securing themselves at the perimeter, but where they're really falling down is with what is going on within their own networks and what is going outbound. They are blocking a lot more potential threats, but there's a lot of risky behavior on their networks as well."One of the biggest problems contributing to the situation is the fact that many workers feel it is acceptable for them to use their work computers for their personal activities, such as shopping, interacting with friends, and searching the Web for popular information, the expert maintains.By using their company-issued devices to head to corners of the Internet where attacks are more prevalent -- such as on e-commerce sites, social networking portals, and independent Web properties, workers are putting their employers at risk of exploit by malware, and other threats, he said.The report found a 3 percent increase year-over-year in terms of the number of remote workers who felt that it was acceptable to use their corporate devices for personal use, such as Internet shopping, downloading music, and social collaboration.Business versus personal use With the rise in attacks being delivered via hacked Web sites and popular destinations including social networking sites, people need to begin shifting their behavior and keeping their work machines separate from their personal lives, Gray contends."At end of day it's not their computer, it's a business tool, and people need to understand how much risk their activity poses for their employers, and that they need some level of separation in terms of their personal use," he said. "Companies may not want people going to the mall in the middle of the day when they could be doing work, but they might not want to allow them to use business tools to do things like e-commerce either."IT workers participating in the study also highlighted the issue with 55 percent indicating their belief that their companies' remote workers are becoming less diligent toward security awareness, an 11 percent increase from the year before.In addition to the growing number of threats being hosted on social networking sites like MySpace, Gray said that the personal data that people share about themselves and their employers on the sites poses a significant risk for the creation of targeted attacks.If an attacker can go to a site like LinkedIn and get a firm grasp on someone's role in an organization and figure out who they might communicate with in the firm, it could be fairly easy for them to create an attack that easily tricks the individual into opening an infected e-mail, according to the expert.However, it would appear that even suspicious e-mail arriving from unknown senders, long the favorite delivery channel for malware and links to phishing sites, continues to stand as a problem.While the numbers of workers in the United States who are willing to open strange e-mails and attachments is far lower at 27 percent, than in places like China (62 percent) and even the United Kingdom (48 percent), many people are still capable of falling for the time-honored ruse.In one interesting twist on the issue of corporate device use, Cisco's report found that more people than ever are also using personal devices that are not under the control or management of their IT departments to access their companies' networks and electronic files. Some 49 percent of those people responding to the survey admitted using their own machines to do so, an increase from 46 percent one year ago.Perhaps the only way to improve the situation will be for companies to enact stricter usage policies for their remote works regarding corporate-owned devices and embracing continued education for end-users about the nature and prevalence of threats, Cisco officials maintain."We need to continue to highlight the problems, companies are doing a much better job than they used to, but with all the blended threats, they need to reload and strengthen the human firewall, which is really the last line of defense," Gray said. "The companies that do the best job have ongoing continuing education for users that tells them that their computer is a business tool and who use monitoring tools to ensure that their security policies are being followed."
81045
(Source: Computerworld) Peace of mind is in short supply these days among IT managers and network administrators, given the dangers out there today. Not only are internal threats ever-present, but highly paid cyber criminals half a world away are almost constantly trying to knock down security walls. The best defense, as it turns out, is a comprehensive risk management strategy.  Download this Technology Briefing to learn more.
468312
A policy and advocacy group called on the Bush administration Tuesday to put more muscle behind cyber-security, and urged the White House to act on a dozen proposals and recommendations to protect the country&#39;s technology infrastructure.
20487
Tech managers fear businesses are more vulnerable to malware because of wireless devices used by workers