Security experts pitch 'culture of data'
504424
The companies that are having the most success in advancing their data security efforts today are those that are finding a way to protect sensitive information without getting in the way of business users, industry experts maintain.
691631
Researchers at Toshiba have developed a method that they say makes possible to absolutely secure distribution of encryption keys across a network.
594403
Health industry, tech firms, government agencies might collaborate to build a secure database of patient records.
376700
Someday, encryption features built into a wide range of IT products -- from operating systems and messaging gateways to hard drives and storage systems -- may work in concert to offer central policy enforcement across different types of network assets and devices.Until that day arrives, however, companies embracing the tools have become dependent on standalone encryption platforms to give them distributed control and policy enforcement across their IT systems.Long known as much for their complexity and demand for hands-on care and feeding as they have been valued for their protective qualities, encryption platforms are finally finding their way into a number of large businesses.This growth in adoption has been driven by the proliferation of data protection regulations and based on the availability of products that address the hardest elements of encryption technology -- policy enforcement and key management, industry watchers contend."The performing of the encryption itself is something that generally belongs close to whatever type of data you are trying to encrypt, whether that is e-mail, network traffic, or a database, but companies are buying into technologies today that allow them to do centralized policy enforcement and key management," said Paul Stamp, analyst with Forrester Research."It's great in theory to say that all of this activity needs to happen in the infrastructure components themselves," he said. "But that's not a reality yet in terms of allowing for centralized management, so customers are turning to these platforms in the meantime."End-users agree that encryption has long been a security process they desired to implement but couldn't stomach based on issues of complexity.The arrival of more usable encryption technology over the last few years has helped eliminate some of the traditional roadblocks, according to some corporate users."From my previous experience with e-mail encryption, I had two major concerns with using the tools: Key management and any dependence on the end-user to make the systems work right," said Michael Gabriel, corporate information security officer for Career Education Corporation (CEC) a higher-education provider that operates more than 75 colleges, schools, and universities."I haven't ever seen an encryption project where management wasn't a major sticking point, that has been the history of the technology, but it seems that the vendors are finally getting it right," Gabriel said. "Compared to mapping the business process, putting the technology in place was a breeze. The only real sticking point was getting the data flow."CEC is using encryption tools made by PGP in cooperation with its data leakage prevention and e-mail filtering systems to protect sensitive information being passed among its employees.Gabriel said that PGP's embedded key management capabilities may be the most valuable aspect of the system -- a feature that simply didn't exist in the past.Other PGP users echoed those sentiments, saying that encryption tools have advanced significantly over the past several years in terms of eliminating the management headaches that have made it challenging to deploy the systems on a wider basis.At American National Insurance Company, IT leaders said that the financial services company had been considering broader use of encryption for several years before the combination of more streamlined technologies and increasing pressure in the form of compliance regulations encouraged the firm to dive in.Today, the company is using PGP tools to both obscure sensitive e-mails and provide whole disk encryption to protect data stored on its desktop and laptop computers."We'd been looking at encryption closely since at least 2005, driven largely by the laws and compliance regulations that were being passed; we needed better e-mail security because we realized after sampling that we had a problem, and knew that we wanted to better protect sensitive information on our computers," said Ken Juneau assistant vice president of Information Technology Services at ANICO."The e-mail product simply sits in the mail flow, and any outbound messages that need to be get encrypted," he said. "Key management was simply the biggest differentiator. The system has almost no overhead in terms of administration; if a key needs to be created, the system handles it, and most end-users never know that the e-mail is being encrypted, which is ideal."With the PGP whole-disk encryption system ANICO is using, Juneau said that key management and the ability to automatically create end-user credential recovery tokens have also proven as easy to use as the insurance company had hoped.Inside smaller organizations, the ability to find encryption platforms that allow for simplified installation and management has been even more acute as the realities of smaller IT staffs make it even harder to deal with any widespread usability issues, experts said.Jason Parks, information systems analyst for Northern California's Butte County Department of Information Systems, said that deploying encryption several years ago was not an option for the government body before it found tools made by vendor Voltage Security that adequately address those issues."The tools have gotten a lot better, which allowed us to move forward with our plans," Parks said."We didn't want to do a bunch of certificate management, and we wanted an easy end-user experience as well. Using the system we have in place, we don't have to give a lot of complex instructions to the users," he said. "We have a limited amount of full-time IT staff in the county, so we couldn't do this until we found something that addressed all the traditional issues with encryption management."Over the course of the two years that Butte County has been working with Voltage's e-mail encryption platform, the IT specialist said that the product has become even more refined and less intrusive to end-users."It's great to see that the encryption vendors are making progress," said Parks. "Encryption is something that a lot of smaller organizations like us need that was not a realistic proposition in the not-too-distant past."Even the vendors themselves admit that encryption tools have changed dramatically in the last several years, allowing end-users to benefit from the protection that the technology can provide without creating massive headaches related to installation and maintenance."We've been trying hard as an industry to find ways to make encryption work better for customers. The issues with this technology have never been related to the level of protection but are more about cost and complexity of the tools," said David Thompson, director of product management at Voltage. "We're trying to change the cost and usability model, and it seems like the time has come when encryption has truly become more feasible for larger numbers of organizations."Phillip Dunkelberger, chief executive of PGP, said that the key to the encryption industry's continued growth and success will be based on its ability to create tools that allow organizations to protect their data without getting in the way of end-users simply trying to do their jobs.The ability for companies like PGP to continue to make their systems easier to use and maintain will lie at the heart of that progress, he said."IT operations are being asked to do more with less. They have smaller budgets for new technologies, greater needs to use information for issues of competitive advantage, and yet they're dealing with huge issues of risks and security threats," Dunkelberger said."The security industry has done itself a disservice by selling [fear, uncertainty and doubt], but we're much better served by looking harder at trying to help lower the cost of ownership and management for these products that address data protection," he said. "How we can do this without adding complexity will be the key to our growth in the future."
165087
(InfoWorld) - Two senior security veterans from Trend Micro are trying to get the industry to change how it classifies malicious software. They argue that today's classification system, which tends to focus on the technical way the software works, neglects a far more important metric that matters more to users: howÂ it tries to steal your money. "This is my pet bug-a-boo -- the unclear language," said David Perry, global director for education at Trend. "I come from 26 years of technical support, and it irks me that we protect people against things and they don't know what we're protecting them against." Perry and Anthony Arrott will present their paper, "New approaches to categorizingÂ economically motivated digital threats," on Friday at a security conference in Vienna. Take the term "virus." The proper definition of virus is a piece of software that replicates or makes copies of itself and attaches itself to other pieces of software. But for nonsecurity professionals, it's "taken to mean the universal indication that there is something wrong with their computer, no matter what the cause," Perry said. Toss in relatively newer terms such as "Trojan horse," "dialer," and "adware" and the situation becomes a mix of confusing vocabulary. Perry and Arrott stop short of proposing a new taxonomy. However, they do detail some parameters that should be considered when building a new framework to categorize Web threats. Although malware categorization systems exist, a new one is necessary because of the focus on economic crime. The "business" models behind the malware are far easier to define than the infinite technical variations that the malware can take, they write. Malware can then be classified into fewer, overlapping categories would help deflect "the endless efforts to determine the exact definitions of the boundaries between categories," Perry said. The new groupings would ideally take into account how a threat is installed, its economic purpose, how it exploits a host computer as well as how it hides itself from detection, the paper said. Another new metric that could be considered is the persistence of threats, since it may more accurately frame the scope of an ongoing fraud. The antivirus industry has tended to focus on "top 10" lists, which indicate the most frequent recent threats but not the most successful attacks over time, the paper said. Trend Micro researched over time fraudulent antispyware programs that were most persistent on computers. This research indicated the diversity and depth of fraudulent programs such as Winfixer or the Zlob Trojan, which purport to fix security problems but install advertising software instead. "Rogue antispyware is just on example of economically motivated threats where chronic persistence is more significant than acute outbreaks," the authors wrote. Perry is hoping for fruitful discussions on taxonomy, although he said the security industry is notoriously fractured and not exactly known for working well together. "There are no grown-ups in this industry," he said. Ultimately, Perry believes the proposal is "a bid toward accuracy and to deconflict the issues that face us as an industry."
720109
Initiative focuses on popular scripting language with the aim to improve security.
6155
High-performance computing and artificial intelligence software may blast through barriers in data management to create a so-called "data cave," like the one Tom Cruise uses to catch crooks in the movie "Minority Report".
530877
European security experts working on plans for a system to notify small and midsize businesses of IT security threats.
372137
As business users increasingly collaborate with each other via the Web, corporate security managers are focusing more on protecting data and enabling anytime/anywhere access.
524188
The Defense Intelligence Agency is becoming a government trend-setter in using Web 2.0 tools for its analysts, who have turned to wikis, blogs, RSS feeds and enterprise "mashups" to collaborate when sifting through data.
633524
Enterprise security decision makers have long been more likely to be swayed by flashy new technologies than by the notion of comprehensive IT restructuring to protect data and other corporate assets, but the situation is evolving rapidly, according to experts participating in Forrester Research's ongoing Security Forum.
131223
DHS' Greg Garcia says his job is to promote security in technology--letting the market decide the best tools--and to get defenders talking to each other.
599092
Research displayed on new security techniques, search advances, more.
294963
Military contractors may be concealing data breaches by international cyberspies.
394748
Storage analytics tools provide managers the facts they need to support what might otherwise be viewed as a risky technical recommendation.
210502
(InfoWorld) - If Werner Heisenberg had pursued business analytics in the early 21st century instead of quantum physics in the early 20th, he might have struck on a different uncertainty principle: If your analysis and decision-making capabilities don't keep pace with the explosion of critical event data across enterprise networks today, soon you won't know the state of your business, the direction it's heading, or how fast it's getting there.Â  A host of technology companies are working on the science behind taking these measurements. Perhaps the newest of these event stream processing or complex event processing vendors is Amalgamated Insight, a Silicon Valley startup founded on work led by co-founder and CTO Michael Franklin at U.C. Berkeley, where Franklin is a professor of computer science. Amalgamated is just emerging from stealth mode and may have a new name by the time you read this. The seed of Amalgamated was planted in Franklin's frustration at what he considered wrong-headed approaches to the analysis problem. Many seemed to think that analyzing event streams -- be they RFID events from sensor networks, service events from SOA networks, system events from traditional networks, events from financial markets, or other kinds of electronic transactions -- was merely a matter of plumbing. If you could just get this device talking with that device, you would somehow enable pervasive computing. "And my view," Franklin recalls, "was that once you solved the plumbing problems, what you've got is a data management problem. Because you've got huge volumes of data being created all over the place. Lots of applications need that data, and lots of users need insight into what's going on in these dispersed environments." Beyond the plumbing, others were trying to reinvent the wheel. Attending an RFID standardization meeting as a guest, Franklin listened as group after group, each working at a different level of the system, described the data at their level and how to access it. And he realized, each one was defining a data model and a query language, and each one was different. That's when the seed sprouted. "Sitting there as a database guy, I was just getting irritated," he says. "Jeez, why wouldn't you just use SQL for all of this stuff across all the levels? And on the way home from that meeting, I realized, well, you know, why don't I just do that." Amalgamated's three-part solution combines a stream processing engine, a Java-based integration framework, and a visualization front end based on Adobe Flex. Naturally, the processing engine, which is embedded into the open-source PostgreSQL database, uses SQL to continuously query events as they flow past. "It lets you write SQL queries that are basically always running," Franklin explains. "They're always producing the answer so far based on the data they've seen so far." To enable SQL to query infinite data streams, Amalgamated extended it in two ways, adding a windowing capability to restrict the amount of data it would be exposed to in any instant and adding some "syntactic sugar" to define event patterns you might want to inspect. The "continuous analysis" engine is adaptive, Franklin says, meaning you can add or remove queries on the fly. Amalgamated sees the decision to embed the core processing engine in Postgres not only as key to advancing the development effort, but also as a key differentiator in the marketplace. Franklin notes that it gave the solution complete SQL, JDBC, and ODBC interfaces, internationalization, and all of the extensibility of Postgres right out of the box. As Boyd Pierce, the company's president and CEO, points out, Postgres lets users of Amalgamated's engine to write SQL that joins tables and streams, provides subqueries and views, and does all the magic that SQL can do. Programmers already know how to code in it. "We got all that based on having Postgres," Pierce notes. "But the other thing we've found in dealing with customers in our application space is that if you don't have a relational database that speaks full SQL and lets people program, you're hugely disadvantaged in terms of doing what the customer needs." Noting that Postgres allowed Amalgamated "to jump in front of a 10-year database systems development curve," Franklin sees a larger lesson in building on the open-source database. "We really hit upon what I think is the future of enterprise software development," he concludes. "If you start from scratch today, if you're building anything complex, you're crazy. That's just not going to be a viable way to build enterprise software in the future. You're going to have to leverage open source and other available tools that are out there."
536795
The rise of customized malware is forcing security software vendors to change their tactics quickly and begin using customers' machines as their initial line of threat detection intelligence, according to a new report from Yankee Group.Echoing recent comments made by industry leaders like Symantec -- which is considering white-listing techniques, among many other emerging plans, to thwart the trend toward so-called server-side polymorphism -- Yankee Group Analyst Andrew Jaquith writes in a new research note that "herd intelligence" will be one of the most effective ways for vendors to detect and address increasingly customized threats.By turning their customers' endpoint devices into malware collectors that can funnel information about new attacks back into their global networks of threat sensors and scanning technologies, Jaquith said, security applications vendors may make faster progress in stemming the tide of lower profile, smaller volume threats.As malware authors have begun enlisting more malware toolkits and other technological means to create a greater number of attack variants than can be found and processed by honeypots and signature-based security software tools, the analyst said, it will become vital for vendors to aggregate threat data using customers' computers.Some smaller vendors, including ESET, Panda Security, Prevx, and Sana Security, have already begun working in such a fashion, turning their deployed endpoints into collectors.Larger vendors looking to add that type of technology to their pallets could seek to acquire one of those vendors, Sana in particular, to advance their plans more rapidly, Jaquith contends.The idea is simple, according to the analyst. If attackers are going to attempt to create different attacks for nearly every individual user, then security software vendors must use their customers' machines as their eyes and ears for discovering and addressing those variants.On the flip side, as the vendors amass information about new attacks, they can simultaneously help other customers determine whether new applications or Web sites are dangerous or safe to use, the analyst said."When an unknown binary attempts to execute, the client-side agent sends detailed telemetry information to a remote centralized server and asks whether it is good, bad, or unknown," said Jaquith. "The server makes a disposition decision based on all the collective history accumulated by the herd. By pooling information about all executing programs across its installed base, the herd makes smarter decisions and can confer immunity faster to new variants."As part of the effort, security vendors may also need to begin sharing more of that information with their rivals to create a larger network effect for thwarting malware on a global basis, according to the expert.It may be hard to convince rival vendors to work together because of the perception that it could lessen differentiation between their respective products and services, but if the process clearly aids on the process of quelling the rising tide of new malware strains, the software makers may have little choice other than to partner, he said."By turning every endpoint into a malware collector, the herd network effectively turns into a giant honeypot that can see more than existing monitoring networks," said Jaquith. "Scale enables the herd to counter malware authors' strategy of spraying huge volumes of unique malware samples with, in essence, an Internet-sized sensor network."Herd intelligence is not without its downsides However, despite the advantages of moving to a herd mentality model, the expert recognizes that there might be significant obstacles for vendors to overcome in making such a transition -- including the cost of shifting away form their existing malware signature creation and distribution methodology.Among the biggest issues for anti-malware vendors to consider is the issue of false positives as many legitimate or nefarious programs may be misclassified by one vendor or the other, and behavior detection-based tools will still be needed to keep an eye out for sites and applications that have been compromised.Customers may represent another hurdle, Jaquith said, as not all companies will initially be comfortable with sharing the necessary level of access with vendors, and some may fear that such a system could offer new opportunities for data loss. Prevx, for one, is already dealing with the issue of privacy by guaranteeing that the only information being sent over its pipelines from customer PCs is related to executable files.An even larger problem could be the "data glut" generated by the herd anti-malware networks."Telemetric data provided by herd endpoints will be substantial," said Jaquith. "Anti-malware vendors will need to spend significant millions of dollars of capital to create scalable infrastructures to collect, process, and store data furnished by endpoints."The white lists of legitimate applications maintained by anti-virus vendors will also need to be updated frequently to address the release of approved programs and patches, a process that will require even additional levels of cooperation between many different types of software makers, he said.Along similar lines, Symantec researchers recently detailed a new program through which they are gathering detailed information about software applications installed onto the computers of customers using its desktop anti-malware suite.Using an opt-out participation model, the experiment studies the behavior and distribution details of individual programs to help make recommendations to users about which programs they decide to install or avoid."Right now, this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it versus what it does," said Carey Nachenberg, a senior member of Symantec's Security Research team."We're hoping to get more clarity through the large base of users we have," he said. "By collecting this data, we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."