RSA: Security firms evolve to tackle new threats
549551
Evolutionary biologists have long theorized that the pace of evolution quickens when a species faces great environmental stress. This idea, of course, is a tough one to âprove,â but we can see examples of it all around us. Just look at the IT security industry, where something akin to drastic environmental change is happening right now: Organized cybercrime groups are punching truck-size holes in enterprise security defenses as regulators, shareholders, and attorneys general are putting pressure on companies to lock down sensitive data. The pressure for change will make this weekâs RSA Security Conference in San Francisco less an industry shindig than a live experiment in evolutionary biology. So walk quietly and keep your field glasses handy to spot some exotic new species in these areas:
487383
The growing functionality of mobile phones is driving demand for new and stronger security products.
198685
(InfoWorld) - Cryptography is no mean field. After all, the science was invented by humans for the purpose of concealing information from other humans. That means that the best cryptographers have to be blindingly smart, with a mastery of mathematics but also a firm grasp of human psychology and, these days, fields such as computer science. Paul Kocher, president and chief scientist of Cryptography Research is a good example of the breed. A cryptography superstar, Kocher is credited with helping discover two different techniques for defeating certain kinds of encryption algorithms. Heâs also a corporate executive whoâs devoted his life to helping create cryptographic applications that can be used in the real world. Kocher sat down to talk security with InfoWorld Senior Editor Paul F. Roberts at the recent RSA Security Conference in San Francisco. Despite making his name by poking holes in encryption, Kocher says that crypto hacks are the last thing enterprise IT should worry about. A much bigger problem is wrestling with the security implications of application and OS âsupersizingâ that is being fueled by a new generation of powerful processors. InfoWorld: Tell us a bit about the history of Cryptography Research and how the security environment has changed since you first started the company.                                                     Paul Kocher: I started Cryptography Research 11 years ago. When I first started working on these problems, we were still at the point where you could understand how systems work. This was back in the DOS days. You had 640K of memory and could run one program at a time. These days, I have no clue whatâs running on my laptop. And you probably have no idea, either. Thereâs too much software there. Mooreâs Law has created obesity in systems, so when youâre trying to come up with ways to keep things secret despite this, itâs an enormous problem. IW: Cryptography is often followed as a kind of arms race, with people who want to make stronger encryption pitted against those who want to break it. Is that the wrong discussion to have? PK: There are a few pieces that are strong. The math behind modern algorithms is incredibly robust. Thatâs the thing most people focus on: âWe have this brick and itâs really strong, so if we have a system that includes this brick, it will also be really strong.â But implementations are where the problems lie. People tend to get enamored with the cryptography and the algorithms and not pay attention to other things that end up failing. IW: You talk about the âbrittlenessâ in much of application security. If you were an enterprise shop with internally developed applications, what steps would you take to reduce that brittleness? PK: One thing Iâd do is just step back and have the engineers think about how they would attack the system. Itâs a different mind set than how to build features. You start looking for that thread that lets you in, and you learn something useful. Also, try to build your application so that it doesnât need sophisticated security capabilities. If youâve got an application on the Web where itâs exposed to outside attacks, just leave the feature out thatâs going to create the risks. IW: What about mobile devices? Microsoft this week announced a new version of Windows Mobile. Are platform companies going to repeat the same mistakes they made on the desktop? PK: I think Microsoft is certainly following the path it followed with the PC, though the security problems havenât caught up yet because mobile devices arenât worth hacking yet. Thereâs an inflection point that people almost never recognize until they hit it. Itâs the point at which a system becomes worth attacking. You hit the threshold when someone figures out that they could make more money attacking your system than by doing whatever it is theyâre doing and after factoring in the risks. At that point, the dynamic changes completely. As you take mobile devices and put more functions on them, someone will wake up and realize that they can make $15 million hacking them, as opposed to the $80,000 to do their current job. We just donât know whether that will be this year or 10 years from now.
671779
Enterprise security products that once focused solely on spam are broadening scope to tackle messaging issues, compliance violations, phishing scams, and viruses.
3394
The security guru for the One Laptop Per Child program unveils his plan to make the rugged machines uniquely resistant to spyware and hack-attacks. Ryan Singel reports from the RSA Conference.
263128
Remember PKI, public key infrastructure? The standard fell out of fashion at the end of the last tech boom, but experts at a recent conference on standards for business applications see a resurgence in the works.
310902
Multibillion-dollar security initiatives have given rise to a new industry seemingly overnight. A News.com special report.
35029
Unpatched vulnerabilities may leave computers open to remote attacks.
273123
The annual [&lt;a href="http://www.networkworld.com/news/financial/rsa.html"&gt;RSA&lt;/a&gt;] Conference, expected to draw 15,000 security professionals and more than 325 vendors from around the world to San Francisco's Moscone Center exhibit hall, kicks off this week with keynotes from industry luminaries Bill Gates and Larry Ellison.
763821
Companies that have spent billions on cyberdefenses to thwart intruders are now addressing an even bigger threat: employees. Many are investing in software that monitors sensitive content inside corporate networks, say security analysts and venture capitalists.
522524
Four vendors of application security products have created an alliance to challenge the ability of large-scale vendors--such as Check Point Software Technologies, Cisco Systems, Juniper Networks
704113
Cisco Systems used the RSA Security Conference in San Francisco to trumpet its transformation from "packet pusher" to "infrastructure" company, unveiling a string of product updates that unify its diverse security portfolio on Monday.
485449
Throughout the European Union, governments are grappling with how to guard against terrorist attacks. Meanwhile, Indian IT services companies have beefed up efforts to protect data.
705475
Anti-phishing applications, smart cards, and new authentication technologies are vying for your support.
209995
A recent court case dealing with key loggers installed by the feds invites the question: will security companies put the interests of their customers first?
262508
Attendees at the RSA conference had mixed views about the value and effectiveness of the PCI data security standard, which is being pushed by the major credit card companies.
105605
A DIRECTOR of technology for security outfit RSA Security has warned online customers are not &quot;authenticated enough&quot; and there needs to be moves towards toward a mandated identity policy.