RSA predicts looming identity crisis
105605
A DIRECTOR of technology for security outfit RSA Security has warned online customers are not &quot;authenticated enough&quot; and there needs to be moves towards toward a mandated identity policy.
318929
Company has made headway on protecting PCs, but more Net use means more challenges, Gates and Mundie tell RSA crowd.
358340
(InfoWorld) - The United Nations last week became the latest organization to warn computer users about the dangers of relying on just passwords to protect online bank accounts and e-commerce shopping carts, according to Reuters The warning from the UNâs International Telecommunications Union came a little more than a year after the United Statesâ Federal Financial Institutions Examination Council (FFIEC) released similar guidance calling for stronger user authentication for online banking customers.                                                     Those kinds of warnings are music to the ears of Jon Fisher, CEO of Santa Clara, Calif.-based Bharosa, which sells anti-fraud and multifactor authentication technology to banks, health care companies, and the government. Just three years old and with 50 employees, Bharosaâs been taking on security industry behemoths such as VeriSign and EMC/RSA on their own turf and, in some cases, winning. In the past year, Fisherâs company signed deals with Wells Fargo, National City, and the U.S. Air Force. A serial entrepreneur who sold his first company at age 23, Fisher spoke with InfoWorld Senior News Editor Paul F. Roberts about how the changing regulatory environment has been good for his company. InfoWorld: What is the core intellectual property that Bharosa has? Jon Fisher: We have a proprietary, gated methodology to screen for fraud in real time. The first gate manifests itself pre-log-in via an analysis of a host of data about the user and transaction. The second gate is at the first point of authentication: the user name and password. The third gate is manifest in session where transaction and document requests occur. The fourth gate is a score of third-party data, whether thatâs enterprise, legacy, or other data thatâs fed into our fraud detection engine. IW: What should enterprises know about software like Bharosaâs? JF: Fraud detection has a place not just in achieving FFIEC compliance, but also truly bringing together disparate legacy systems [that] enterprises have had in place for some time. IW: Are you talking about single sign-on, or something else? JF: Single sign-on is an application of that. But fraud detection [can make] a decision about what advanced forms of authentication to use based on the conditions, or what kinds of transactions will manifest in certain ways, like a document request or [bill payment].Â  IW: Arenât authentication and fraud detection ultimately just parts of a bigger architectural change that will tip the scales in favor of vendors who can take care of data security in addition to authentication and storage and the networking piece? JF: Iâve been an entrepreneur for a number of years. I know that if you want to start a company and run a good company, youâve got to do something well. Weâve selected a few things to focus on and do well. Theyâre things that, in aggregate, constitute more than just a point solution. But, yes, certainly less than the array of products in unrelated areas offered by competitors. In terms of how the competition in the space breaks out in the next few years, because of the importance of fraud detection â especially in the enterprise â some very large companies are looking at the space and deciding what their strategy will be. If you have a key product like [Bharosa] fraud detection thatâs embedded deep within some of the worldâs finest enterprises, no matter how much the space matures or develops and no matter what resources competitors have, you still have to work with Bharosa. IW: In the financial services space, how much of this is being driven by FFIEC guidance around single factor authentication? Where do things stand with adoption of FFIEC? JF: There are two answers. As an objective observer, Iâd have to agree that more than 50 percent of U.S. banks will technically not comply with FFIEC-related guidance by the end of the year. However, as a principle at Bharosa, Iâm finding that FFIEC compliance has served as rocket fuel for my relatively young company. Itâs been a key driver in our growth. Weâre very much looking forward to the second phase of FFIEC guidance in 2007. Weâre also looking for the effect this guidance will have on other markets. These mandates for enterprises to update security as a function of time are great environments to work in if youâre a software company.
602631
(InfoWorld) - Public key infrastructure is poised for a resurgence, with associated identity technologies increasingly underpinning applications as organizations look to securely share information, vendors said Tuesday at a standards conference in London. While it was a hot buzzword during the peak of the technology boom, PKI fell out of favor as IT projects were increasingly seen as bloated and without sufficient focus. "PKI still has a lot of perception problems," said Stijn Bijnens, senior vice president of identity management for Cybertrust. Bijnens was one of several participants in a conference by the Organization for the Advancement of Structured Information Standards (Oasis), a consortium that developments standards for business applications. PKI uses certificates that have been verified by a certification authority and allows other organizations or people to exchange trusted information. PKI simplifies e-government and e-commerce by letting a person identify themselves once to a certification authority that vouches for the person's identity when they interact with other organizations in the infrastructure. Several changes in IT should spur growth of PKI. Microsoft Corp.'s release of its next generation OS, Windows Vista, contains technology to help users manage identities, called CardSpace, Bijnens said. CardSpace will allow users going to compatible Web sites to have greater control over how their personal information is released. While it's unknown how CardSpace will work with other identity technologies, it should help grow the market for certificate accreditation and procedures around identity verification, Bijnens said. "Microsoft just enables the market for everyone," Bijnens said. Governments are undertaking electronic-identity projects that should also foster interest in PKI technology, Bijnens said. But PKI technology faces hurdles, too. The technology is growing increasingly complex even for those familiar with it, said Arshad Noor, of StrongAuth Inc. Noor said he was once involved with a PKI implementation at one of the largest pharmaceutical companies for its 120,000 employees worldwide. The chief executive officer (CEO) expected the rollout could be done in about five weeks. The rollout eventually finished, but not on the CEO's time scale, he said. "It was absolutely crazy," Noor said. "I think management needs to understand they are implementing more and more complex technology." Also key are the policies built around identity sharing. However, those policies often must rapidly be adjusted as businesses acquire other ones or business processes change, Noor said. Another problem with exchanging identities using PKI is establishing one authority that can vouch for identities, something that so far hasn't happened. "The framework doesn't exist yet," Noor said. Â
265642
InfoWorld - Oracle on Wednesday announced a new project to tackle one of the thorniest problems facing enterprises: the proliferation of sensitive identity information across enterprise networks.
739021
Radio Frequency Identification technology is going to ring in the new year in more ways than one.
5819
A new software platform for protecting your identity could offer clues to the success of Fusion.
442479
The fight against identity theft in the U.S. isn't going so well, according to new research released by Gartner Inc. And it doesn't look like it's going to get better anytime soon.
115380
America Online is teaming up with RSA Security in an effort to keep its users safe from online fraud and identity theft. RSA and AOL are announcing a new program called &quot;AOL PassCode&quot; that will encourage AOL
341952
Personal identity has taken on a new meaning in the digital age, where basic facts like your name, address or age are far less important to some people than the collected records of what you were looking at online.
44699
Bill Gates is right about one thing: asking people to use a two-factor form of authentication would go a long way toward alleviating a lot of the password problems that plague computer security today.
32344
In a comment yesterday on Marc Canter's blog, discussing the race to be the default identity system for the Internet.. "I wouldn&#185;t count out Google, they've got a lot of users, and a lot of money. I think they could probably buy Yahoo, but someone else would have to do the math." Ashkan Karbasfrooshan did the math.
311572
Consultant reveals how even banks ignore security The conventional wisdom that banking organisations are more diligent with security was skewered in a presentation at the RSA conference this week.â¦
174942
Plus: Are you having an identity crisis? [News.com Extra]
479866
Encryption circles are buzzing with news that mathematical functions embedded in common security applications have previously unknown weaknesses.
589694
The outsourcing of security Comment It's the end of yet another RSA security conference, and we're tempted to trade our PCs for an abacus and hole up in the basement while the nightmarish robot invasion on mankind plays out. Malware, we were repeatedly told over the past five days, is lurking everywhere - in PCs, phones and online bazaars - and is waiting for the opportune moment to slip into our toasters and refrigerators.â¦
447369
A new key acquisition will bolster its RSA division.