U.S. Bancorp, VeriSign team on banking security
504348
U.S. Bancorp will use VeriSign's Unified Authentication service to validate and secure interactions with commercial banking customers, providing them with a secure USB token they must use when accessing services online.
180823
(InfoWorld) - Managed security services companies SecureWorksÂ  and LURHQÂ Â have merged. The combined company is known as SecureWorks and is based in Atlanta. SecureWorks chief executive Mike Cote remains as chief executive officer (CEO) and former LURHQ CEO Tony Prince will be executive vice president responsible for product development. The companies sell consulting services to corporations that are looking for outside security expertise to help lock down their networks. SecureWorks is best known for managing intrusion prevention products, which protect the network from outside attacks. LURHQ is focused on monitoring internal threats with its Security Information and Event Monitoring service. The combined company has 1,500 clients and manages 5,000 security devices worldwide. "The markets and the technologies are very complementary," said Prince. Over the past few years, however, it has become increasingly difficult for smaller companies to compete in the security space as customers turn to larger vendors like AT&T Inc., VeriSign Inc. or IBM Corp. looking for more comprehensive products. Last month IBM announced plans to acquire SecureWorks competitor Internet Security Systems. Now, SecureWorks will have a better chance of competing, said Sandra Palumbo, a senior analyst with Yankee Group Research Inc. "They are competing in a pretty crowded market and in some cases size does matter," she said. "It definitely is a merger that makes a lot of sense." Only four positions are expected to be eliminated as a result of the deal, which closed Friday. The combined company now has about 200 employees, SecureWorks said. SecureWorks made headlines recently when one of its researchers, David Maynor, claimed to have found a way to take control of an MacBook by exploiting a flaw in a wireless card. In a video, Maynor and another security researcher named Jon Ellch demonstrated the hack using an undisclosed third-party wireless card, but claimed that Apple Computer Inc. was also affected by the vulnerability. An Apple spokeswoman later claimed that Maynor and Ellch had "not shared or demonstrated any code," relating to this flaw that was "relevant to the hardware and software that we ship." SecureWorks declined to comment further on the Apple matter.
744877
SAN FRANCISCO - Banks and credit card agencies are gearing up security for financial transactions over cellphones and other handheld devices. Aware that a growing number of consumers - especially those under 35 - are comfortable using cellphones as digital wallets, leading financial institutions are concocting mobile-security options to protect them from hackers and cyberthieves.
528623
Vormetric&#39;s CoreGuard helps Ocwen protect confidential information in its online exchange for the mortgage industry. By Steven Marlin.
491058
(Source: VeriSign)  Securing your consumers, brand, Web sites and network from advanced threats while pleasing the customer is a must. Yet, most security technologies protect one layer while leaving others vulnerable to attack. Learn how to protect all of your confidential data and transactions with VeriSign Layered Security.
251253
(InfoWorld) - Executives from the financial data transfer company Swift and the president of the European Central Bank (ECB) faced tough questions in a European Parliament committee meeting Wednesday, about the illegal sharing of private data with U.S. authorities. ECB chief Jean-Claude Trichet denied that the bank should have stepped in to prevent the breach of European data protection laws, saying that the bank could only advise the Society for Worldwide Interbank Financial Telecommunication SCRL (Swift). "We have no judicial competence in the field of data protection," he said. Swift's Chief Financial Officer Francis van Bever explained that the company has two information storage facilities, one in the U.S. and the other in Holland. Each facility holds identical data: they serve as back-ups for each other in case one were to crash. "Each facility is subject to local laws," Van Bever said. "We were obliged to respond to the subpoena from the U.S. authorities." European law is unclear, he said, adding that after getting external legal advice in Belgium, Swift concluded that transferring the data to the U.S. authorities would be legal. "We didn't check with local data protection authorities because we thought what we were doing was legal," he said. U.S. agencies ordered Swift to share millions of pieces of information about people and companies from around the world in the wake of the terrorist attacks on Sept. 11, 2001. The information was deemed essential in tracing the financing of terrorism, and Swift complied with the order. However, European data protection laws forbid transfers of European citizens' personal data outside the E.U. if the country receiving the data has aÂ weaker data protection regimeÂ than Europe's. The U.S. is considered such a country under European laws. In June the New York Times revealed that Swift has been sharing the data with U.S. authorities for years, sparking investigations in Europe into how the European laws could so easily have been breached. Last week, Belgium's privacy commission concluded a two-month investigation, accusing Swift of breaking Belgian and Europe-wide data protection laws. However, it stopped short of proposing fines for the company, which it agreed was caught between conflicting legal requirements on each side of the Atlantic. Many European parliamentarians drew a parallel between the Swift case and the ongoing attempts to strike a data sharing agreement that would allow the U.S. authorities access to personal data about passengers flying to the U.S.. They were unimpressed by what more than one member of the European parliament referred to as "buck-passing" when it came to handing out responsibility for the data protection breach. Trichet tried to move the debate beyond casting blame by suggesting ways of avoiding similar problems in future. "This problem is ongoing," he said. "The system we have in place is imperfect. It is very important to clarify the situation and work out what to do about such data transfers across the Atlantic." He added that any agreement between the E.U. and the U.S. should then form the basis for a global solution, because the problem is worldwide. "We need a global legal framework for situations like this," Trichet said. Swift's van Bever agreed. "We would welcome such clarification," he said, adding that the double taxation treaty could be a role model. The treaty is signed by many countries around the world and is designed to prevent people being taxed twice on the same income by different tax authorities.
473454
Looking to expand its presence among New York financial companies, security services vendor Perimeter eSecurity has acquired Secure Electronic Communications Compliance Archival System ( SECCAS ), a small seller of e-mail management products.Based in New York, SECCAS sells Web-based software that can be used to archive and manage e-mail, instant message and Bloomberg messaging data, giving smaller financial institutions a quick way of bringing their IT systems into compliance with government regulations.Terms of the deal -- Perimeter&#39;s 11th over the past four years -- were not disclosed.Perimeter sells Internet-based software-as-a-service products to financial institutions, and the acquisition will give the company new services to sell to brokers, registered investment advisors and hedge funds, the company said.Founded in 1997, Perimeter is based in Milford, Connecticut. Last year the company closed two rounds of funding, picking up $104 million in investments. It has a staff of 300.
84701
(VeriSign)  These days, people conduct business from virtually anywhere, thanks to continual advances in Internet technology. As enterprises begin to accommodate the demands of this "Any Era," threats to your infrastructure inevitably increase. VeriSign has created a Layered Security solution to provide added security without sacrificing a rich user experience.
8012
IBM Monday introduced a security service that offers a concise, monthly global-network threat report designed to help organizations assess security needs and vulnerabilities from a business perspective.
697608
Business software maker's backing of event comes as company faces continued scrutiny over its security practices.
266836
Across the security industry, experts are encouraging businesses to abandon piecemeal IT systems and data-defense efforts in favor of overarching risk management strategies.According to some customers, consultants, and vendors, the strategy is starting to prove particularly helpful in addressing issues of identity management and access control.Long identified by industry analysts as an area where businesses often end up "chasing rainbows" and getting involved in never-ending projects, experts contend that by adopting a risk-based model to drive identity management, customers' goals are actually being realized."When developing our architecture, it became very clear that one of the processes that was important to tackle before starting to change things in one region or business unit was to do risk assessment and integrate all the subjects related to access control," said Paulo Martins, enterprise identity and access manager at financial services giant ABN AMRO.In 2006, the banking company made a decision to rework its identity infrastructure as part of an effort to make access control an even more central focus of its enterprise security strategy.Rather than simply looking for a new technology to improve its standing, ABN AMRO found that by getting a fix on the areas of its business where controlling access to sensitive data was most crucial -- and then assessing the varying levels of efficacy within its existing operations -- it found a way to move its project forward faster and with a greater sense of direction."As companies get larger and the numbers of applications increase, and they grow through mergers and acquisitions, they find that they have different levels of maturity related to identity and access," said Martins. "We built our strategy considering all of these things. The first year was dedicated to process and access control reviews; the second year involved implementation of those processes and use of risk analysis for critical applications."Among the most valuable topics that ABN AMRO was led to consider as part of its process, he said, was where it made sense to automate identity-based control for its applications and where it did not.By gauging the number of users and criticality of the data involved in each area of its business, the company was able to set its priorities and get controls in place where the risk of information loss was most widespread or severe, said Martins.Using risk management to prioritize security As part of its project, ABN AMRO brought in consultants from PricewaterhouseCoopers (PwC) to help map out its areas of need and define where its greatest data and identity risks lay.Jerry Lewis, a principal and national identity management leader at PwC, said that his company is advising more customers to tackle their projects using a risk management strategy because it allows them to refine their plans and improve their security standing with greater alacrity."We're definitely seeing risk management becoming the next real extension of identity management," Lewis said. "Most large companies we see have spent a lot of time and money putting solutions into place to drive various requirements -- such as in addressing compliance regulations -- and once they have the infrastructure installed, they realize that they need to use more of a risk-based approach."Lewis said that more customers than ever are starting to adopt the risk-based identity management approach to get a better fix on handling applications and systems access from an enterprise-wide manner.Those companies' immediate goals tend to revolve around their desire to improve identity management reporting capabilities, and to create dashboards that garner metrics related to potential compliance audits, he said."People are looking at this issue from more of a broad perspective, based on regulatory drivers, and focused on very specific applications or needs," Lewis said."Doing so, these companies are able to take a step back and find out what they really need to address first," he said. "They want the company-wide view, but they're also realizing that they typically can't have a complete end-to-end solution across the organization that is one size fits all and that they need use this risk-based approach."As a result of the success that companies are having using the strategy, the consultant said that more customers have earmarked funds to buy products that apply the risk-based approach to identity during 2008.One of the vendors PwC works with in the space, and the software provider to ABN AMRO, is SailPoint, a startup founded in 2005 whose products are focused squarely on identity auditing and analytics as well as policy enforcement and the creation of automated controls.SailPoint executives said that customers are looking for a new generation of identity management tools that address the issues that will help them pass audits and give them more of a top-down view into where their organizations stand in terms of securing access."People began getting pressured to address issues of compliance and audit around Sarbanes-Oxley, but traditional identity tools were not designed to solve those problems, they were mostly about improving operational efficiency, and people have been stretching those technologies to do things they weren't designed to do," said Mark McClain, chief executive and founder of SailPoint."Most of these systems were initially designed to set up accounts and do password resets, but with compliance needs, it has to become more about governance and risk assessment," he said. "Customers are frustrated because they've spent all this money dealing with the terms of the regulatory audits, yet the breaches have continued because they haven't been able to address the real risks."
446018
Business & money: Criminal investigation into possible fraud and insider trading involves some of world's largest banks
358340
(InfoWorld) - The United Nations last week became the latest organization to warn computer users about the dangers of relying on just passwords to protect online bank accounts and e-commerce shopping carts, according to Reuters The warning from the UNâs International Telecommunications Union came a little more than a year after the United Statesâ Federal Financial Institutions Examination Council (FFIEC) released similar guidance calling for stronger user authentication for online banking customers.                                                     Those kinds of warnings are music to the ears of Jon Fisher, CEO of Santa Clara, Calif.-based Bharosa, which sells anti-fraud and multifactor authentication technology to banks, health care companies, and the government. Just three years old and with 50 employees, Bharosaâs been taking on security industry behemoths such as VeriSign and EMC/RSA on their own turf and, in some cases, winning. In the past year, Fisherâs company signed deals with Wells Fargo, National City, and the U.S. Air Force. A serial entrepreneur who sold his first company at age 23, Fisher spoke with InfoWorld Senior News Editor Paul F. Roberts about how the changing regulatory environment has been good for his company. InfoWorld: What is the core intellectual property that Bharosa has? Jon Fisher: We have a proprietary, gated methodology to screen for fraud in real time. The first gate manifests itself pre-log-in via an analysis of a host of data about the user and transaction. The second gate is at the first point of authentication: the user name and password. The third gate is manifest in session where transaction and document requests occur. The fourth gate is a score of third-party data, whether thatâs enterprise, legacy, or other data thatâs fed into our fraud detection engine. IW: What should enterprises know about software like Bharosaâs? JF: Fraud detection has a place not just in achieving FFIEC compliance, but also truly bringing together disparate legacy systems [that] enterprises have had in place for some time. IW: Are you talking about single sign-on, or something else? JF: Single sign-on is an application of that. But fraud detection [can make] a decision about what advanced forms of authentication to use based on the conditions, or what kinds of transactions will manifest in certain ways, like a document request or [bill payment].Â  IW: Arenât authentication and fraud detection ultimately just parts of a bigger architectural change that will tip the scales in favor of vendors who can take care of data security in addition to authentication and storage and the networking piece? JF: Iâve been an entrepreneur for a number of years. I know that if you want to start a company and run a good company, youâve got to do something well. Weâve selected a few things to focus on and do well. Theyâre things that, in aggregate, constitute more than just a point solution. But, yes, certainly less than the array of products in unrelated areas offered by competitors. In terms of how the competition in the space breaks out in the next few years, because of the importance of fraud detection â especially in the enterprise â some very large companies are looking at the space and deciding what their strategy will be. If you have a key product like [Bharosa] fraud detection thatâs embedded deep within some of the worldâs finest enterprises, no matter how much the space matures or develops and no matter what resources competitors have, you still have to work with Bharosa. IW: In the financial services space, how much of this is being driven by FFIEC guidance around single factor authentication? Where do things stand with adoption of FFIEC? JF: There are two answers. As an objective observer, Iâd have to agree that more than 50 percent of U.S. banks will technically not comply with FFIEC-related guidance by the end of the year. However, as a principle at Bharosa, Iâm finding that FFIEC compliance has served as rocket fuel for my relatively young company. Itâs been a key driver in our growth. Weâre very much looking forward to the second phase of FFIEC guidance in 2007. Weâre also looking for the effect this guidance will have on other markets. These mandates for enterprises to update security as a function of time are great environments to work in if youâre a software company.
25491
A bank that guarantees its online users safety and security has direct evidence that its Web-based banking system is not bullet-proof. Should that bank tells its users?
727372
(Source: Verisign)   Be sure that your online business is ready for safe transacting.  Find out what consumers are looking to be safe online.
737824
(InfoWorld) - IBM owns some of the world's leading IT security talent, products, and services, but executives with the massive company say it will likely never aim to become what people might label as a true "security vendor." The technology giant has added high-profile security assets in the last year alone, acquiring such companies as applications testing specialist Watchfire in June 2007 and managed services and hardware giant ISS in Aug. 2006. However, unlike rivals like Microsoft -- which has moved to stake a claim in the anti-virus, messaging, and collaboration security segments with its own products -- executives say that Big Blue is more interested in blending security further into its existing products and services than it is hopeful of becoming a more mainstream security provider. Under IBM's control are security offerings that range from its Tivoli group's identity management and compliance software packages to the gateway appliances made by ISS and outsourcing services provided by its Global Technology Services unit. Yet the common theme throughout the company's overarching strategy is not one that emphasizes competition in hot markets or via standalone products, executives say, but rather an approach that attempts to mix security skills into almost all of its existing business lines as a component of its larger vision. "We're not really focused on selling a bunch of security products and services. Our drive is to embed as much security capability as possible in the platforms we have, along with our operating systems, business services, and everything else," said Stuart McIrvine, director of IBM corporate security strategy." "Security is absolutely one of the core critical areas where IBM is focused as a corporation," he said. "But it's more about making it easier for customers to manage all these technologies that we offer and make those technologies more secure themselves." Repeating that IBM is in the business of marketing "secure business solutions," versus selling security products, McIrvine said that the company approaches its strategy under a three-pronged approach that centers on infrastructure security, corporate risk management, and compliance automation. All of those efforts tie back into the notion of lowering customers' security concerns either by bolstering the onboard protection of its products or fostering business controls that benefit areas like regulatory compliance, the executive said. Case in point is the just-underway work to integrate Watchfire's applications scanning tools into IBM's own Rational software development platform. The effort is being undertaken in the name of helping businesses drive security further into their own software development efforts, a trend that is currently sweeping across that sector. And while industry experts say that customers are only just beginning to build security testing into their software development process, IBM's move to stay ahead of the trend was validated when rival HP purchased applications scanning provider SPI Dynamics to blend into its own Mercury platform just weeks after the Watchfire deal was announced. Along with augmenting its perimeter protection capabilities via ISS, expanding identity management tools across many of its business lines, and fostering data governance efforts to benefit issues like compliance and data leakage prevention, IBM is, however, focused on growing its presence in some burgeoning security niches. Among those are management of encryption technologies and enterprise data discovery, which will fold accordingly into many of Big Blue's existing offerings, McIrvine said. "Encryption key management has been around a long time, but because encryption is growing so quickly and there are so many different areas that require keys, companies are struggling with the overall process of adopting it more broadly," McIrvine said. "It's a very complex area, and admittedly we still have a lot of work to do on it ourselves, but there's an opportunity for tools and services that manage the entire encryption key lifecycle, and we're doing a lot of research and development in that area." One of the hallmarks of companies trying to avoid data breaches and comply with state and federal data-handling regulations is that most of the organizations still have problems figuring out where all of their sensitive information is stored and how it is accessed, the executive said. Those factors will continue to drive interest in so-called e-discovery tools, and IBM can parcel the systems into its data governance, compliance management, and managed services businesses as demand for the technology evolves, according to McIrvine. "Discovery is an example of a less mature market that will become increasingly mainstreamed over the next two to three years and where we think it makes sense for us to invest," he said. Industry watchers observed that it is sometimes hard to understand exactly what IBM's overarching security strategy may be, but the experts admitted that the challenge therein may lie in taking account of the diverse range of products and services that the company is adding security components in support of. IBM will likely deal with growing pains as it works to integrate all of its security acquisitions and products, said Paul Stamp, analyst with Forrester Research. However, the company has added some compelling security assets over time, he said. "I don't think you'll ever see IBM go out and try to buy all the pieces needed to become a true security player, as it were, but they can offer customers a significant portion of what they might need, especially in relation to their other products," Stamp said. "They have made a lot of investments; the difficult part for them will be putting everything they have together." Stamp said that IBM will likely use security most effectively to continue to grow the margins of its massive services business. Other experts agreed that IBM has never had a particularly clear security strategy but observed that it has added pieces that fit its corporate goals around building true "solutions" packages." "The problem in understanding IBM's security vision is that it is scattered around so many divisions, and something like risk management is not a product that we can talk about in traditional terms," said Andrew Jaquith, analyst with Yankee Group. "I don't think we'll ever look at IBM as a security company in the pure sense, it's not in their DNA, but we will see that they provide elements of security throughout their offerings." "I typically avoid the word 'solution' as it's usually misleading, but in this case with IBM and security is actually fits because they have hardware software and services, and they will continue to pull those packages together in a way that also includes security," the analyst said.
635768
Bank of America's optional SafePass service works with customers' mobile phones to improve security for online banking.