Industrial security - it's not the same as IT security
188708
Niche market potential In the past, equipment control for manufacturing processes on the shop floor tended to be carried out by discrete systems running arcane real time operating systems controlled by proprietary management systems that had no connection through to other systems.â¦
310488
(InfoWorld) - Companies are losing the battle to secure their IT systems from attacks by hackers and other threats, warned Bruce Schneier, the founder and chief technology officer of Counterpane Internet Security. "I don't think, on the whole, we are winning the security war; I think we are losing it," Schneier said in a speech, which was webcast Wednesday at the Hack In The Box Security Conference (HITB) in Kuala Lumpur, Malaysia. As systems get more complex, they getÂ less secure, according to Schneier. Even as security technology improves, the complexity of modern IT systems has increased at a faster rate. "The Internet is the most complex machine ever built," Schneier said. "This explains why security is getting worse." In addition, the nature of the threat that companies face has changed in important ways. Where hacking was once considered a profession for hobbyists, a growing number ofÂ hackers are now criminalsÂ with a profit motive. "The nature of the attacks are changing because the adversaries are changing," Schneier warned. "They have different motivations, different skill sets and different risk aversions." Hobbyists now represent the minority of hackers, according to Schneier. This change means hackers pose an even greater threat to companies. "The hobbyist is more interested in street cred, the criminal wants results," he said. To turn the battle in its favor, the security industry must look beyond purely technical measures, according to Schneier. "Look for the economic levers," he said. "If you get the economic levers right, the technology will work. If you get the economics wrong, the technology will never work." Externalities, an economic term used to describe the effects of one person's actions on another, are central to building effective security, Schneier said. For example, U.S. banks do not spend heavily toÂ defend against identity theftÂ because they are not affected when such theft occurs. To the banks, this is an externality. However, when banks bearÂ liability for a security breach, such as an unauthorized ATM withdrawal, they make the investments necessary to prevent these incidents from taking place, he said. The same economic lessons can be applied to software vendors. To improve the security of software, Microsoft and others should be made liable for selling software that is not secure. "When you use buggy software and you lose data, that's your loss and not the software company's loss," Schneier said. That needs to change, according to Schneier. "The organization that has the capability to mitigate the risk needs to be responsible for the risk," he said HITB runs through Thursday, Sept. 21.
452393
It is no secret that enterprise networks are increasingly under attack from a variety of sources that are difficult to thwart. To address the problem, many are turning to outside security providers, which is driving  the rapid evolution of new safeguarding technologies, according to  research conducted by the Yankee Group.
146912
A new airport security system relies on human judgment
595194
The most vexing weakness in computer security is not in the hardware or the software, it is in the people who use the machines, according to top hackers and cyber safety specialists.
356771
While corporations are monitoring ports and using advanced security tools to fend off infection and attack, home users -- who have less technical sophistication -- are left more susceptible, sometimes
562916
The big bucks companies are spending on security often don't cover the biggest threat, survey finds.
769598
One of these things is not like the others ...
56532
People have long been the weakest link when it comes to protecting computers. The same applies to mobile phones, a security expert says.
753082
(Source: Credant)  New technology to meet security, operations, and compliance needs Security has evolved beyond merely encrypting "bits on disks". The paradigm must shift from Full Disk Encryption to Full Data Encryption to protect against insider threats and avoid significant manageability and usability issues.
537741
As the TJX Companies data leakage incident seeped its way further toward becoming the Exxon Valdez of corporate information spills this week, researchers reinforced the notion that businesses continue to make a mess of electronic data security because they fail to foster adequate internal communication.A new report from Ponemon Institute -- which has produced a series of studies into corporate data leakage over the last several years -- concluded that the various people in charge of collecting, protecting, and managing sensitive information inside large businesses typically don't collaborate sufficiently. Those constituencies also have widely differing views regarding their respective roles in safeguarding the content, the report contends.Echoing comments made by a number of security policy experts in recent months, the study highlights the fact that companies are likely failing to protect data based on broken business processes -- at least as much as they may be succumbing to complex technological challenges.Just as many software developers complain that their applications are left vulnerable to attack because business teams refuse to wait long enough for the programs' underlying code to be made secure, the results of Ponemon's survey of 3,600 IT security and marketing executives -- located in the United States, the United Kingdom, and Germany -- illustrate a distinct lack of organizational coordination in the name of protecting data.For instance, only 30 percent of the marketing workers interviewed for the study said they actually consult security teams before collecting and using sensitive information, while 80 percent of the IT security employees surveyed indicated a belief that they are typically involved in such decision-making.In addition, while only 53 percent of IT security workers surveyed said their companies have well-coordinated data protection policies, only 32 percent of those workers who handle the information said their employers are doing an adequate job. Some 45 percent of security workers don't feel that their data-handling rules get in the way of business objectives, while only 21 percent of the people using the content feel that such policies represent roadblocks to their productivity.And in yet another blow to the perceptions of security workers, only 21 percent of the marketers using sensitive information interviewed by Ponemon said that security teams play a leading role in defending the content.At the heart of the matter is the issue of poor collaboration between all the involved parties, according to the research firm. Only 29 percent of those interviewed said their companies' current policies would be adequate to handle a major breach within 24 hours of its occurrence.Based on the results, Ponemon contends that organizations with substandard data protection collaboration policies were twice as likely as to have had a data breach within the last two years.Therein lays the ultimate proof of collaboration's impact on data protection, said executives with Microsoft, which sponsored the research report."We expect the data threat environment to continue to evolve, and at the same time, clearly, there's a long way to go based on where we are today," said Brendon Lynch, director of privacy strategy at Microsoft. "There's this major issue around the degree to which marketing professionals consult with these other involved parties; they see the policies as getting in the way of business objectives, and they're not interacting with security or privacy specialists based on that, which undermines the process change that companies are already attempting to enact."As part of its connection with the study, Microsoft is pushing the notion that companies should merge their security and data privacy operations to simplify the process of interaction between the various constituencies.Some 80 percent of all respondents to the Ponemon study said that they would support further combination of those teams to improve coordination of their data defenses."We feel that most companies need to be more holistic and bring these types of roles together," said Lynch. "All of these workers are critically important to better locking down the data, so they need to look at developing appropriate-use cases, and how to better fulfill business objectives while maintaining protection."The study is just the latest expert opinion to highlight the fact that despite the ever-expanding range of security technologies available to enterprises to protect sensitive data, many organizations could be well served to start with a review of their internal policies.In addition to getting business teams to work more closely with security and privacy pros, some experts contend that organizations could improve security risks quickly by merely retrenching the settings of their network and IT systems.Many critical infrastructure systems are installed with the idea of getting an operation up and running first, with plans to bolster security after the fact, and never readdressed, said Paul Williams, chief technology officer at IT security services provider Global Security Management.Reviewing networking gear settings to ensure that they have been sufficiently obscured, along with tweaking the features of other systems crucial to protect external attack is another way that companies can significantly bolster data security with little to no capital investment, he said."Before you learn how to defend a network, you have to take a walk on the wild side and see how you can break in yourself," said Williams. "Most networks can be made more secure by simply taking the time to go back and see how things were installed and whether or not the settings were changed in a way that promotes security; people typically look to technology solutions to address these problems, but they could begin helping themselves significantly at relatively no cost."In a presentation delivered at the Gartner IT Symposium earlier this month, analyst Neil MacDonald told attendees of the show that they could save money on their security projects if they continue to push for a more thorough, process-driven approach to data protection on a high level within their organizations."This can't be about managing a set of projects, it has to be about improving process," MacDonald said. "At the end of the day, the idea of tagging every piece of data in an enterprise for the sake of protecting it is unfeasible; it sounds great on paper, but the problem is a monumental effort with new information coming in all the time, it's not a process that's sustainable."
191515
Despite vendor claims to the contrary, security scanners and source-code analysis tools are generally speaking not up to the job of protecting your company's network, says one McAfee VP.
622272
Blog: Imagine configuring a security policy and having it enforced across the IT infrastructure? That's the aim of "Stirling," a new product unveiled at TechEd.
732682
Security workers warn that encrypting stored data doesn't truly protect it, and you're fooling yourself if you think so.
415230
As networks increase in size and complexity, security products are growing in sophistication and security threats are becoming more ingenious.
185091
The plethora of security technologies on the market is enough to overwhelm even the most knowledgeable IT managers, but in sorting through all of the options, it may be helpful to look at what is not needed.
19923
Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.