Insider Threats Remain IT's Biggest Nightmare
562916
The big bucks companies are spending on security often don't cover the biggest threat, survey finds.
62609
With viruses, worms, spyware, spam and phishing, running a computer this year -- especially one with Windows -- has often been a colossal headache. -Rob Pegoraro
219087
If you thought e-mail threats were a pain, that's nothing. Trend Micro's Raimund Genes talks about the latest Net-borne danger to the computing world.
25871
The nation&#39;s biggest insurers are mired in a brewing scandal that many executives fear could shake the industry to its core. After
137976
Critics say a law designed to keep medical information confidential is being overzealously applied.
289303
(InfoWorld) - The Department of Homeland Securityâs Computer Emergency Readiness Team (US-CERT) raised a few eyebrows in late November when it sent a warning out to U.S. banks and financial institutions about a possible cyber attack by Islamic militants. The alert, dated Nov. 30, was triggered by a posting on what the DHS considered an Islamic jihadi Web site calling for hackers to attack U.S. financial and banking Web sites, apparently to protest the detention of Muslims at Guantanamo Bay, Cuba. However, the warning was heavily qualified, with DHS calling the threat âmore aspirational than operational.â Financial firms downplayed the danger, too. One security executive at a major brokerage told InfoWorld that the warning was a ânon-event.â But could repeated warnings about such non-events eventually make critical infrastructure owners deaf to DHSâs warnings? InfoWorld Senior Editor Paul F. Roberts recently chatted with John Carlson, senior director of security and risk Assessment at BITS, a financial-services industry consortium focused on security, fraud, and risk management, about the DHS warning and state of the public-private partnership on cybersecurity. InfoWorld: Iâm guessing that your members received the US-CERT warning about the cyber terrorist attack? John Carlson: There were two messages sent: the first was [Nov. 30]; then a second revision came out [Dec. 1]. The gist of it was that these reports were not corroborated. IW: What was the reaction of BITS members to the warning? JC: Our members have an âall hazardsâ approach to business-continuity planning. Theyâve got well-developed approaches that have been bolstered since 9/11. In response to new regulatory requirements, firms have done a lot to improve backup, theyâve done tests with the various exchanges. Theyâre also working in closer harmony with the federal government to share information on threats and vulnerabilities. I think thereâs a spirit of appreciation that the government is willing to share information with the financial services industry. The firms take that information into account in responding and activating their business continuity plans. IW: How do your members apply information like this that comes from DHS? JC: Iâm not sure I can give a blanket answer. Each firm has its own mechanisms for gathering information. Risk-management professionals at these firms read the paper and understand the military conflicts and theyâre mindful of that. They take it into account when they have employees traveling. Theyâll monitor where they are. With the [bird flu] pandemic issue, firms were monitoring that closely and trying to figure out what impact it would have on their organizations. IW: Is there a danger from these warnings of creating a âBoy Who Cried Wolfâ situation, where firms begin to disregard the warnings? JC: Thereâs always a concern about the crying-wolf syndrome. But our firms appreciate getting the information even if itâs not corroborated. A continuous flow of information helps build trust between the private and public sectors. IW: Was this warning about the jihadist threat something that your members see all the time, or was this an unusual kind of warning from DHS? JC: I think the warning came across the transom at a high level [saying] âpay attention to this.â So it was different from what we normally get. Weâre getting a steady stream of information on threats and vulnerabilities and a range of things. For example, if thereâs a known virus thatâs being perpetrated in [the United States] or against a financial institution. Weâre also getting information on political changes around the world. IW: Do you think DHS has its arms around the cybersecurity problem? JC: My personal opinion is that the government has some capabilities, but not all capabilities. In general, our firms would like more information, but there are many reasons why if (the government) has the information they donât provide it. But itâs a touchy question. People have lots of different views. Â  IW: Do you feel like your members are getting all the information they need? JC: Thereâs some filtering, but I donât have information to compare or validate what the filter is. We talk about issues through coordinating councils that meet quarterly. Itâs a two way conversation.Â
632816
Calls concerns over undercover updates to Windows XP and Windows Vista a tempest in a teapot.
537741
As the TJX Companies data leakage incident seeped its way further toward becoming the Exxon Valdez of corporate information spills this week, researchers reinforced the notion that businesses continue to make a mess of electronic data security because they fail to foster adequate internal communication.A new report from Ponemon Institute -- which has produced a series of studies into corporate data leakage over the last several years -- concluded that the various people in charge of collecting, protecting, and managing sensitive information inside large businesses typically don't collaborate sufficiently. Those constituencies also have widely differing views regarding their respective roles in safeguarding the content, the report contends.Echoing comments made by a number of security policy experts in recent months, the study highlights the fact that companies are likely failing to protect data based on broken business processes -- at least as much as they may be succumbing to complex technological challenges.Just as many software developers complain that their applications are left vulnerable to attack because business teams refuse to wait long enough for the programs' underlying code to be made secure, the results of Ponemon's survey of 3,600 IT security and marketing executives -- located in the United States, the United Kingdom, and Germany -- illustrate a distinct lack of organizational coordination in the name of protecting data.For instance, only 30 percent of the marketing workers interviewed for the study said they actually consult security teams before collecting and using sensitive information, while 80 percent of the IT security employees surveyed indicated a belief that they are typically involved in such decision-making.In addition, while only 53 percent of IT security workers surveyed said their companies have well-coordinated data protection policies, only 32 percent of those workers who handle the information said their employers are doing an adequate job. Some 45 percent of security workers don't feel that their data-handling rules get in the way of business objectives, while only 21 percent of the people using the content feel that such policies represent roadblocks to their productivity.And in yet another blow to the perceptions of security workers, only 21 percent of the marketers using sensitive information interviewed by Ponemon said that security teams play a leading role in defending the content.At the heart of the matter is the issue of poor collaboration between all the involved parties, according to the research firm. Only 29 percent of those interviewed said their companies' current policies would be adequate to handle a major breach within 24 hours of its occurrence.Based on the results, Ponemon contends that organizations with substandard data protection collaboration policies were twice as likely as to have had a data breach within the last two years.Therein lays the ultimate proof of collaboration's impact on data protection, said executives with Microsoft, which sponsored the research report."We expect the data threat environment to continue to evolve, and at the same time, clearly, there's a long way to go based on where we are today," said Brendon Lynch, director of privacy strategy at Microsoft. "There's this major issue around the degree to which marketing professionals consult with these other involved parties; they see the policies as getting in the way of business objectives, and they're not interacting with security or privacy specialists based on that, which undermines the process change that companies are already attempting to enact."As part of its connection with the study, Microsoft is pushing the notion that companies should merge their security and data privacy operations to simplify the process of interaction between the various constituencies.Some 80 percent of all respondents to the Ponemon study said that they would support further combination of those teams to improve coordination of their data defenses."We feel that most companies need to be more holistic and bring these types of roles together," said Lynch. "All of these workers are critically important to better locking down the data, so they need to look at developing appropriate-use cases, and how to better fulfill business objectives while maintaining protection."The study is just the latest expert opinion to highlight the fact that despite the ever-expanding range of security technologies available to enterprises to protect sensitive data, many organizations could be well served to start with a review of their internal policies.In addition to getting business teams to work more closely with security and privacy pros, some experts contend that organizations could improve security risks quickly by merely retrenching the settings of their network and IT systems.Many critical infrastructure systems are installed with the idea of getting an operation up and running first, with plans to bolster security after the fact, and never readdressed, said Paul Williams, chief technology officer at IT security services provider Global Security Management.Reviewing networking gear settings to ensure that they have been sufficiently obscured, along with tweaking the features of other systems crucial to protect external attack is another way that companies can significantly bolster data security with little to no capital investment, he said."Before you learn how to defend a network, you have to take a walk on the wild side and see how you can break in yourself," said Williams. "Most networks can be made more secure by simply taking the time to go back and see how things were installed and whether or not the settings were changed in a way that promotes security; people typically look to technology solutions to address these problems, but they could begin helping themselves significantly at relatively no cost."In a presentation delivered at the Gartner IT Symposium earlier this month, analyst Neil MacDonald told attendees of the show that they could save money on their security projects if they continue to push for a more thorough, process-driven approach to data protection on a high level within their organizations."This can't be about managing a set of projects, it has to be about improving process," MacDonald said. "At the end of the day, the idea of tagging every piece of data in an enterprise for the sake of protecting it is unfeasible; it sounds great on paper, but the problem is a monumental effort with new information coming in all the time, it's not a process that's sustainable."
82473
Worms, viruses and Trojan horses will remain a top security concern in 2005, according to executives at this week's CSO Interchange forum in New York.
518121
A senior security expert at the networking giant says that aspects of Microsoft's new operating system are worrying.
292352
In a story for the Associated Press this afternoon, one of the directors of Microsoft's Windows Client Product Planning team is quoted as saying that a Black Hat security conference demonstration last August scared Microsoft to the point where the company seriously considered removing virtualization capability from Vista entirely.
496947
Among the new challenges: keeping Sarbanes-Oxley expenses under control and "their CEOs out of jail."
316372
Employee-owned consumer devices used at work present a threat that security professionals must manage, analysts say.
268157
Threat of legal action keeps security firm from detailing RFID security flaws at Black Hat event.
512307
Concerns raised over senior officers' threat to patient confidentiality.
645815
Wall Street is being spooked by the wrong fear. The ''I'' word is scarier
494051
In the recent annals of corporate fraud, the names Enron, Tyco and WorldCom ring the loudest.