Clarke: Using technology to secure IDs is vital
529176
In the age of prevalent terrorism, identity needs stronger protection, says counterterrorism expert.
312106
The d2 SAFE hard drive is designed to keep intruders away from private data, and comes equipped with a biometric sensor, 128-bit AES hardware encryption technology, and chain lock port for maximum protection against unauthorized use.
5819
A new software platform for protecting your identity could offer clues to the success of Fusion.
40481
(InfoWorld) - Whitfield Diffie has been credited with making privacy possible in the digital age. As a co-inventor of public key cryptography, he is one of the most respected contributors to the field of computer security and is in constant demand as a speaker. In his day job as Sun Microsystems' Chief Security Officer, he works out of a corner office in the Sun Labs. He's just down the hall from where scientists are working on Java-based sensors and Sun's next-generation Proximity Communication processors, which seek to do away with wire connections. Though he describes his job as a "marketing" position, Diffie doesn't sound anything like a corporate pitch man. He met with IDG News Service at his Menlo Park, California, office recently to share his thoughts on Microsoft, security, and privacy. Following is an edited transcript of that conversation. IDGNS: When the PC went on the network, there were security implications that nobody thought about. Microsoft has spent the last five years fixing all of the security problems that maybe could have been foreseen ... Diffie: Wait a minute. I think there are two issues. I think you'll find that lots of them were foreseen. I think the critical thing [is] that Microsoft showed that it's judgment was correct. If it had paid less attention to security, maybe it would have had less market share. It had no real motivation, I think, until the last few years to try to fix these things. The interesting thing to me is why it's been so hard for them to do so, because they must have half the smart people I know about in the industry, and in security, working for them. And I think it has to do with the problems of legacy code, and the legacy interface expectations of their customers. IDGNS: Nowadays we don't hear about widespread security outbreaks, but there's a sense that many of the things we do on the Internet are not trustworthy. People going to Web pages do not have confidence that they are where they think they are. Diffie: I think that's a well-placed mis-confidence. IDGNS: So, are things getting better? Diffie: Phishing is the security problem, at that level, that I hear the most about right now. But I certainly don't worry about the security arrangements of going to Americanexpress.com, where I probably make the single largest most routine money transfer that I initiate. I'm not the least bit worried about that, partly because of the law, and partly because the essential point of SSL [Secure Sockets Layer -- a standard used in secure Web connections] is not about the quality of the cryptography -- about which there's often some doubt - but about the fact that the certificate costs enough money that the thieves aren't putting up a front. It's hard for me to believe that [the Internet] is getting relatively more secure. The growth of communications has steadily outrun the protection of communications over the whole history of human communication. Now I conjecture that the expansion of networked communications and of society's dependence on network communications is outrunning the security of that network and will continue to do so for quite some time. So the consequence of believing that is [believing] we're becoming more vulnerable, although to what events, it is hard to say. IDGNS: I think that ties into an interesting point you made earlier: This lack of security is a fair price to pay for growth. Diffie: Look at the biggest claim of theft against Microsoft that's been made in the last 10 years. It has 99 percent penetration in the Chinese market and 1 percent payment in the Chinese market. The business asset to them of being able to claim that they were ripped off at the same time that they gained this market of 1 billion people is fantastic. Security is always political. That is to say, it always advantages somebody and disadvantages somebody else. IDGNS: What are your current thoughts on privacy? Diffie: I believe in privacy, but privacy is just one of a number of considerations. Privacy of political conversation is essential for a democratic society. Is the privacy of information about yourself necessary for it? That's not very clear. It's a very squishy concept. In small communities you have very little privacy, but you have accountability, because you know who the members of the community are. What bothers me is that information about people is so readily available in a way not auditable to them, to organizations like ChoicePoint, who broker it around and enable other people, who are not legally constrained in what they do with it, to make decisions based on it. I am, on balance, more pleased with the fact that I can learn lots of information about people in minutes by using the Web than I am concerned about the fact that people can learn lots of information about me that way. And I would not like to see laws that restrict people's ability to go investigate things. Here's my scenario: For all its current faults, it won't be 10 years before facial recognition gets incredibly good. And it will be a PC thing, not a big money thing. So everybody's camera will be saying 'Hi" to the people who go by. Putting a camera right where you sign your signature with your credit card enables any store to build up a database of its customers. So if they see you coming down the street they can change the display in the window. But then that's going to produce all these databases of information about people. Very small operations will be able to collect information. Would I like to see that outlawed? I doubt it. I think what outlawing it would be saying [is] that certain classes of big boys -- the Fortune 1,000, the secret police -- would be allowed to have access to such information, but you little irresponsible children won't be. So I have a cowboy viewpoint on this.
328517
TechWeb - Multipurpose cell phones, data-storing pocket knives: Can you fear me now?
691149
(Source: IDC) Encrypting data in transit is a start - but encrypting data in storage is widely recognized as the next frontier in security. Find out how you can mitigate financial risk, prevent identity theft, block internal leaks and more - while keeping your vital information accessible and manageable.
758985
Americans seek international database to carry iris, palm and finger prints
679573
The importance these days of protecting your business from security threats is clear. But how to do it well often remains a vexing problem. Major IT vendors have faced this challenge like everyone else -- but with a twist. As providers of security technology and IT systems vulnerable to threats, they've had to stay a step ahead of everyone else. That's why CIOs of technology stalwarts IBM and Intel and security technology provider Symantec have taken on security management as one of their key functions. All three companies have shared their lessons learned with InfoWorld.These CIOs have had to do more than take on the usual responsibility for driving their respective companies' efforts to defend their infrastructure, employees, and corporate reputations from any fallout related to data breaches or compliance violations. They've also had to be the in-house beta testers for a generation of new technologies their organizations hope to sell to customers. This balancing act demands more of their time and energy now than at any other point in their careers, all of the executives said.Security affects all of it "When I look at the risks here at Symantec, I know that we have to maintain a multilayered approach to protecting our IT assets: our ERP data, intellectual property, customer data, and personnel data. Managing the risk around all of that is a significant responsibility for me and my team," said David Thompson, CIO at Symantec."We have multiple large pools of information that are critical to our organization, and we're seeing more of that data move further toward the boundaries, toward the end points," he said. "My job is getting more data into the hands of our business units, but that creates a lot of risk in terms of where it goes, who has access to it, and what they are using it for, along with the risk of it being exposed."Even Thompson, who ranks his ability to "eat Symantec's own cooking" -- or use all of its security and compliance technologies -- as a huge advantage compared to CIOs working in other firms, admits that trying to keep up with all of the threats and regulations, as well as all the new products, is an effort that can become all-consuming.The key to staying ahead of the attacks and laws, while not spending too much of his time focused on security, is delegating to a strong team of experts and prioritizing which projects to tackle based on their criticality to Symantec's business. "As a business leader and IT executive, if you take the view of trying to fix everything, you'll never sleep a wink. You have to assess risks, and just as we'll never be able to completely secure our borders in the United States, you have to prioritize efforts to reduce risk as much as possible," Thompson said. "CIOs themselves must have a team that can help carry a good portion of the load so that they can stay focused on business relationships, clearing roadblocks, and being the public face of that team."Among the most critical roles that any CIO or technology executive must play in aiding the efforts of their security staff is to drive high-level assessments of risk and figure out how their companies must strategize to complete projects that address the most significant threats and compliance regulations, Thompson contended. The most effective strategy, he noted, is to determine which projects most readily address specific threats or government requirements and focus on them, he said. Otherwise, a broad-brush approach to security will lead to unnecessary complexity and eat up all of your time. Thompson also noted that even with the latest security technology available to him, the security strategy is more important than just having good security tools.At IBM, CIO Mark Hennessy also stressed the importance of delegating to his team of security experts and of conducting near-constant risk assessment. But even with that delegation, security remains a top focus for him, he said. "The world is changing, and there are a lot of new realities around security to address. Fostering stronger security across the board is a core tenet, as it helps to bring more value to everything we do," he said. "We want to make our employees more comfortable and more productive, and drive greater success for the clients we serve, so it's something we constantly need to remain focused on," he added.The security-vs.-complexity challenge Malcolm Harkins, general manager of Intel's Information Risk and Security unit, works directly with the chip giant's CIO Douglas Busch on issues of internal operational security and compliance. Harkins said that one of the biggest challenges that organizations such as Intel face is the process of improving security in the face of rapidly advancing IT complexity.On top of that, ongoing efforts to lower the total cost of securing a company the size of Intel -- while keeping up with emerging threats and regulations -- is driving the firm to seek greater standardization in some areas, and to integrate larger groups of technologies in others. "We currently have over 40 individual security software and hardware providers that we are doing business with, and that's a lot of different pieces to have to integrate," Harkins said. "It's almost crazy from an IT standpoint, so we want to employ greater levels of standardization to help us with issues of consistency; we'll always have a very heterogeneous environment, but we really need a more consistent set of tools. The more standardization you have, the easier it is to make things more secure."One of the most crucial steps any company can take in terms of improving its security is driving understanding of the attacks and laws across their highest executive ranks and ensuring that leaders who become involved in matters of security maintain realistic goals and objectives, Harkins said.But that does not mean being heavy-handed in terms of the security levels demand, he noted. C-level executives who take an extremely conservative approach and desire to aggressively lock down all their IT systems may in fact do more harm than good, he said. "Some companies believe that by severely limiting the use of technologies that pose risks, they are improving their defenses, but the truth is they may just be creating a false sense of security," Harkins said."In reality, they are limiting the ability of their business to operate effectively and are increasing risk by creating barriers and policies that can't be enforced practically," he said. In IT, "you have to work with [C-suite] to change their approach from one that is focused on responding to fears to one that is focused on key controls that solve real problems. You have to have executive buy-in, but by taking the wider approach of considering legal, compliance, and security issues together, you will end up with stronger protection, lower costs, and less complexity."
199682
Unthinkable a year ago, perhaps, but there are currently indications that Microsoft is starting to think about identity management systems in terms of interoperability. A meeting  later this month with vendors and other organizations such as the Liberty Alliance promises to be productive.
523265
roundupThere's no question retailers love RFID. But will problems of privacy and unreliability prove to be too great?
405148
Passwords are out and tokens are the authentication wave of the future, right? Not so fast, says Jon Espenschied. The next next thing is both stranger and more familiar.
607963
Now there are tools available online to safeguard against the theft of Social Security numbers.
234398
QUESTION: What is the best approach to protecting me from ID theft and related activities? Will a software package work best, or must I go to a hardware firewall?
164007
(InfoWorld) - Experts gathered for the ongoing InfoWorld Enterprise Data Protection Forum in New York today said that companies need to get a better handle on all the factors that make their sensitive information susceptible to attack and become more proactive with their overall defensive strategies if they are to improve on their current security status. In a panel presentation featuring leading security executives and consultants, experts highlighted a need for businesses to study all the elements that contribute to classifying their most valuable information as truly sensitive. Protecting records whose value is immediately apparent -- such as social security and credit card numbers -- isn't enough as companies must also shroud any related data that can be used to create an individual profile that could be used to carry out identity theft or other forms of fraud, the speakers said. By defending all the contextual data that can be used to create such a picture, enterprises can greatly reduce their risk and move beyond more obvious strategizing, said C. Warren Axelrod, chief privacy officer at financial services giant U.S. Trust. "What's interesting in financial services is that it is the combination of data that becomes valuable information when it comes together to create an identity," Axelrod said. "If you are just going to file away social security numbers with no way to tie them to identity, they're actually pretty innocuous; but even if you just have a way to associate that information to a phone number or other data, someone can put things together." Axelrod said for the record that "data protection is a contradiction in terms," and that the process will never be perfected, based on the nature of IT systems and the need for businesses to easy retain access to important information.Â  The only way to effectively improve data security is to create a governance hierarchy that allows IT workers to better classify all types of information and to elevate protection of anything that can be used to create an individual portrait, he said. IT consultants agreed, saying that they are advising their customers to use contextual data to help carry out their regulatory compliance projects with greater efficacy. "It's the context that data is used in that qualifies it for regulatory oversight," said Peter Robinson, senior manager for financial services information security at BearingPoint. "You have to protect both the data and all this other information." Perhaps the biggest challenge facing enterprises today in improving their overall data security strategy is becoming more proactive about trying to expect attempted misuse or theft of information, and putting more intelligent tools in place to defend themselves before those situations arise, said Pamela Fusco, chief security strategist at consultancy FishNet. Fusco, who chaired the panel, is also a former chief security officer at financial services bellwether Citigroup. "We don't write a law unless something happens first, as with seat belt laws. We write regulations because something happens, but those are reactive," Fusco said. "Most consultants feel as if we're in reactive versus proactive mode for data protection and integrity." Regulations like the Sarbanes-Oxley Act have proven less effective than legislators might have initially hoped they would be at improving overall data security because businesses have focused on meeting the terms of the guidelines versus boosting their overarching protection schemes, Fusco and other panelists agreed. However, some industry-driven security requirements, such as the PCI (payment card industry) standard forwarded by credit card issuers, have had the desired effect, experts said. Well-written guidelines can help make the difficult task of convincing senior executives to increase their IT security budgets easier, alleviating one of the most significant challenges of the entire data protection process, according to Steve Peltzman, chief information officer at the Museum of Modern Art in New York. "We had to spend a lot of time and money on [PCI], but now I'm thankful for it because I don't have to go through the same routine of convincing everyone that this effort is important," Peltzman said. "The credit card companies got together and made it more expensive for us not to deal with [data protection], which is a good example of industry coming together to create a standard that's actually good." In a seemingly-rare occurrence, the security experts agreed that the creation of an additional, worldwide data protection standard -- as proposed to the assembled group by FishNet's Fusco -- could prove useful in furthering their efforts to secure attention and funding for their data protection strategies. For global companies in particular, establishing such a global guideline could be effective, they said. "The international difference in data protection priorities is an issue. If it could be resolved to where we could get universal classification and more people building innovative solutions, that could be a big benefit," said Erich Mueller, security analyst for Allstate Insurance. BearingPoint's Robinson agreed that such a standard could provide much needed support for security pros. "Anything that can advance the understanding and foster the culture of security in the executive suite is a positive. We've all been trying to do things like this for ourselves for years," Robinson said. "A standard that can help shorten the education cycle and get us where we need to be is something that I would support."
250322
Step away from all the vendor hype. The one device that will always be the best tool for information security is a competent security professional.
461062
Executive offers advice on how to combat growing security threats linked to use of Bluetooth-equipped devices.
392137
(InfoWorld) - Whitfield Diffie has been credited with making privacy possible in the digital age. As a co-inventor of public key cryptography, he is one of the most respected contributors to the field of computer security and is in constant demand as a speaker. In his day job as Sun Microsystemsâ chief security officer, he works out of a corner office in the Sun Labs, just down the hall from where scientists are working on Sunâs next-generation Proximity Communication processors, which seek to do away with wire connections. Although he describes his job as a âmarketingâ position, Diffie didnât sound anything like a corporate pitch man when he spoke with IDG News Service reporter Robert McMillan at his Menlo Park, California office recently. The following is an edited transcript of that conversation. InfoWorld: When the PC went on the network, there were security implications that nobody thought about. Microsoft has spent the last five years fixing all of the security problems that maybe could have been foreseen.                                                     Whit Diffie: Wait a minute. I think there are two issues. I think youâll find that lots of them were foreseen. I think the critical thing [is] that Microsoft showed that its judgment was correct. If it had paid less attention to security, maybe it would have had less market share. It had no real motivation, I think, until the last few years to try to fix these things. The interesting thing to me is why itâs been so hard for them to do so, because they must have half the smart people I know about in the industry, and in security, working for them. And I think it has to do with the problems of legacy code, and the legacy interface expectations of their customers. IW: Nowadays we donât hear about widespread security outbreaks, but thereâs a sense that many of the things we do on the Internet are not trustworthy. People going to Web pages do not have confidence that they are where they think they are. WD: I think thatâs a well-placed misconfidence. IW: So, are things getting better? WD: I certainly donât worry about the security arrangements of going to Americanexpress.com, where I probably make the single largest most routine money transfer that I initiate. Iâm not the least bit worried about that, partly because of the law, and partly because the essential point of SSL [Secure Sockets Layer â a standard used in secure Web connections] is not about the quality of the cryptography but about the fact that the certificate costs enough money that the thieves arenât putting up a front. IW: I think that ties into an interesting point you made earlier: This lack of security is a fair price to pay for growth. WD: Look at Microsoft. It has 99 percent penetration in the Chinese market and 1 percent payment in the Chinese market. The business asset to them of being able to claim that they were ripped off at the same time that they gained this market of one billion people is fantastic. IW: What are your current thoughts on privacy? WD: I believe in privacy, but privacy is just one of a number of considerations. Privacy of political conversation is essential for a democratic society. Is the privacy of information about yourself necessary for it? Thatâs not very clear. Itâs a very squishy concept. In small communities, you have very little privacy, but you have accountability because you know who the members of the community are. What bothers me is that information about people is so readily available in a way not auditable to them, to organizations like ChoicePoint, who broker it around and enable other people, who are not legally constrained in what they do with it, to make decisions based on it. I am, on balance, more pleased with the fact that I can learn lots of information about people in minutes by using the Web than I am concerned about the fact that people can learn lots of information about me that way. And I would not like to see laws that restrict peopleâs ability to go investigate things. Hereâs my scenario: For all its current faults, it wonât be 10 years before facial recognition gets incredibly good. So everybodyâs camera will be saying "hi" to the people who go by. Would I like to see that outlawed? I think what outlawing it would be saying [are] that certain classes of big boys â the Fortune 1,000, the secret police â would be allowed to have access to such information, but you little irresponsible children wonât be. So I have a cowboy viewpoint on this.