Managed SOHO security still lacks polish
607967
Two boxes bundling managed security service with SMB-level firewall/router/gateways and DSL have appeal to smaller businesses and admins managing remote users, but our testing raised questions.
135055
Don't WEP for me Argentina Wireless networks almost trebled in London over the last 12 months with more, but not all organisations, realizing the importance of running secure networks.â¦
604623
This organization's IT security officer leaves and isn't replaced. A year and a half later, the organization suffers a Web page defacement and malware attack -- and no one is really surprised.
429964
A variant of an older worm is poorly designed, but it nonetheless shows the effectiveness of our manager's incident-response process.
386296
The facts of web servers don't necessarily match the myths when it comes to security.
391310
Internet Security Systems' intrusion prevention software on Crossbeam Systems security switches.
392137
(InfoWorld) - Whitfield Diffie has been credited with making privacy possible in the digital age. As a co-inventor of public key cryptography, he is one of the most respected contributors to the field of computer security and is in constant demand as a speaker. In his day job as Sun Microsystemsâ chief security officer, he works out of a corner office in the Sun Labs, just down the hall from where scientists are working on Sunâs next-generation Proximity Communication processors, which seek to do away with wire connections. Although he describes his job as a âmarketingâ position, Diffie didnât sound anything like a corporate pitch man when he spoke with IDG News Service reporter Robert McMillan at his Menlo Park, California office recently. The following is an edited transcript of that conversation. InfoWorld: When the PC went on the network, there were security implications that nobody thought about. Microsoft has spent the last five years fixing all of the security problems that maybe could have been foreseen.                                                     Whit Diffie: Wait a minute. I think there are two issues. I think youâll find that lots of them were foreseen. I think the critical thing [is] that Microsoft showed that its judgment was correct. If it had paid less attention to security, maybe it would have had less market share. It had no real motivation, I think, until the last few years to try to fix these things. The interesting thing to me is why itâs been so hard for them to do so, because they must have half the smart people I know about in the industry, and in security, working for them. And I think it has to do with the problems of legacy code, and the legacy interface expectations of their customers. IW: Nowadays we donât hear about widespread security outbreaks, but thereâs a sense that many of the things we do on the Internet are not trustworthy. People going to Web pages do not have confidence that they are where they think they are. WD: I think thatâs a well-placed misconfidence. IW: So, are things getting better? WD: I certainly donât worry about the security arrangements of going to Americanexpress.com, where I probably make the single largest most routine money transfer that I initiate. Iâm not the least bit worried about that, partly because of the law, and partly because the essential point of SSL [Secure Sockets Layer â a standard used in secure Web connections] is not about the quality of the cryptography but about the fact that the certificate costs enough money that the thieves arenât putting up a front. IW: I think that ties into an interesting point you made earlier: This lack of security is a fair price to pay for growth. WD: Look at Microsoft. It has 99 percent penetration in the Chinese market and 1 percent payment in the Chinese market. The business asset to them of being able to claim that they were ripped off at the same time that they gained this market of one billion people is fantastic. IW: What are your current thoughts on privacy? WD: I believe in privacy, but privacy is just one of a number of considerations. Privacy of political conversation is essential for a democratic society. Is the privacy of information about yourself necessary for it? Thatâs not very clear. Itâs a very squishy concept. In small communities, you have very little privacy, but you have accountability because you know who the members of the community are. What bothers me is that information about people is so readily available in a way not auditable to them, to organizations like ChoicePoint, who broker it around and enable other people, who are not legally constrained in what they do with it, to make decisions based on it. I am, on balance, more pleased with the fact that I can learn lots of information about people in minutes by using the Web than I am concerned about the fact that people can learn lots of information about me that way. And I would not like to see laws that restrict peopleâs ability to go investigate things. Hereâs my scenario: For all its current faults, it wonât be 10 years before facial recognition gets incredibly good. So everybodyâs camera will be saying "hi" to the people who go by. Would I like to see that outlawed? I think what outlawing it would be saying [are] that certain classes of big boys â the Fortune 1,000, the secret police â would be allowed to have access to such information, but you little irresponsible children wonât be. So I have a cowboy viewpoint on this.
481653
I'm back, with a very interesting topic too!  Joel Spolsky, ex-Microsoft Manager and software engineering guru has a new essay, How Microsoft Lost the API War that is creating quite a big storm in the blogging communitiy.  Joel posits that the priests in the holy Temple of Microsoft have lost their way, because it has split into two factions, and the wrong faction is winning. One faction worships on the alter of backward compatibility, while the other is led by fervent priests who are proselytizing to raise up the new gods of .NET and Longhorn. Joel suggests that the new gods will cause the destruction of the holy Temple because Microsoft's great victories were built on the altar of keeping customers happy with backward compatibility. Furthermore the old gods of the Windows API continue to grow more grotesque and cruel with the passing of time, driving former worshipers into the arms of the friendlier gods of World Wide Web.  This story sounds extremely plausible. I must admit that i fit the profile of the developer who used to develop on the Window's API, is familiar with COM and Win32 who now develops mostly using PHP and Python. However I continue to develop and maintain Windows apps that keep our customers happy, and we still plan to develop new Windows apps. Some points:  Temple of the Blind? Firstly, Microsoft is still a compelling place to work for to people who feel that they can make a difference. The Temple continues to attract talented people with a Unix background. For example we have the recent hiring of Ward Cunningham, author of the Wiki.  Microsoft is still able to keep talented people like Raymond Chen, and others like him who continue to look after the Windows API, and Longhorn apparently will still give high priority to backward compatibility. Open sourcerers like Miguel Icaza are sufficiently attracted to the .NET vision to stake their careers on Mono. Longhorn and .NET are compelling technologies, so even if Win32 is not so cute anymore, M'soft is providing something that remains very attractive.  What i do see M'soft doing wrong is that they aren't disseminating the .NET runtime fast enough. It remains an optional install in XP Service Pack 2 for example. Also their IE dev team appears to be hog-tied due to political reasons; nevertheless IE remains good enough, particularly when I can embed IE as an activeX control, something I cannot do with Mozilla (AFAIK) - Update: I'm wrong.  Temple of the Spider?  Secondly, people don't merely use a web browser. They run the web browser in the OS.  So let me ask you, if you are using DreamWeaver or HomeSite or Photoshop or vi or emacs or Gimp, how many of you are willing to give it up for a java applet (or whatever your favorite technology is) running in your web-browser? Precisely.  Temple of the Abandoned?  Third, Joel makes the claim that developers are not developing to the Windows API. Well he could be right. But I bet a lot of them are still calling Win32.  If you are using a framework or IDE like Delphi or wxWindows (or .NET or VB) then you certainly are insulated from the Windows API, but that doesn't mean that you're not calling the Windows API all the time. I don't see Borland dropping their Windows version of Delphi at any point in time.   In fact, the fact that many developers are using some form of framework is a compelling argument for Microsoft to enhance the .NET framework to attract developers who are using other frameworks.  Today, not that many students learn x86 assembler, but that doesn't mean that Intel lost the CPU wars. Just because fewer people are learning Win32 doesn't mean Microsoft has lost the API wars, if the frameworks run predominantly on Win32.  Temple of the Lost  Joel even warns you in the beginning that "because I'm talking about big trends, I need to exaggerate and generalize". But you still get sucked in because Joel Spolsky is a first-class writer, in the same order as Philip Greenspun or Eric Raymond. That makes him so persuasive and plausible. But this is not Indiana Jones and doomed temples, but Steve Jobs and reality distortion fields.  Other opinions:  Harry Fuecks (PHP is ASP's upgrade path),  Dennis Hamilton (M'soft is just covering all bases), Robert McLaws (Joel is wrong in 7 points), Oliver Travers (the web is not good enough), One Run-time to Rule them all....
195221
Windows XP Service Pack 2 promises to raise the security bar for the sometimes beleaguered operating system. Unfortunately, one of the new features could be spoofed so that it reports misleading information
609370
Businesses may be spending millions on expensive security technologies aimed at thwarting data leakage and compliance violations, but many companies are still failing to sufficiently address access controls for protected information and IT systems.According to the latest report from Ponemon Institute, most IT workers readily admit that their companies are doing a sub-standard job of keeping tabs on the level of access available to employees, temporary workers, and independent contractors.In Ponemon's 2008 National Survey on Access Governance, based on interviews conducted with roughly 700 IT professionals, 78 percent of those people surveyed reported that their employers are not regularly reviewing policies or tools that control admittance to their systems or information.The situation has resulted in an environment where many workers retain the ability to view sensitive data or manipulate IT systems that they should not be able to access based on their job responsibilities, researchers said.Some 69 percent of those interviewed said that their companies' access policies were either enforced poorly or not at all, with only 30 percent of respondents stating that their organizations go to the trouble of validating their guidelines.The overwhelming lack of proactive efforts to keep a handle on issues of access are somewhat shocking based on all the attention being given to data security and compliance issues over the last several years, and many business could greatly improve their overall standing simply by improving their policies and enforcement capabilities, said Larry Ponemon, chairman and founder of research firm."Traditional approaches, including homegrown technologies and manual management processes, have proven to be fraught with failure and risk. Unless enterprises acknowledge business as usual is failing, we believe rampant access mismanagement will continue to plague organizations," Ponemon said. "When it comes to access rights, companies don't want to constrain workers and make their jobs harder, but they have to manage things in a more systemic way that look at the risk versus the benefits, and many organizations are obviously having difficulties with that."Approximately 55 percent of those participating in the survey said that their employers' ability to grant access based on a worker's role and job function is either poor or nonexistent, including 42 percent who said that their companies have no policy to manage things in such a manner.The rapid pace of change in the responsibilities among today's workforce is one of the biggest hurdles that companies struggle to overcome, said executives with Aveksa, a maker of access control software that sponsored the Ponemon report."This entitlement drag issue is a major problem. IT organizations are under pressure and often either valued or devalued by business based on how quickly they deliver access," said Brian Cleary, vice president of Marketing for Aveksa. "Clearly, the findings here show that that while companies are doing a good job of providing initial or changed access, there is no automated way to go back and make a determination to understand if a workers' current level of access is appropriate."Lessons learned from Jerome Kerviel Issues of access control are of fundamental importance to corporate risk management, perhaps best exemplified by the recent reports of the activities of Jerome Kerviel, a stock trader at French firm Soci?t? G?n?rale who is accused of losing nearly $8 billion of his company's capital in unapproved transactions carried out by circumventing rules built into the brokerage's IT systems.Had Soci?t? G?n?rale been actively monitoring the access controls for its transactional systems, Kerviel likely would have been caught long before he gambled away such a stunning amount of money, the experts contend.A major factor contributing to the continued loopholes in access management is a lack of support for improving policies and applying technologies used to govern the issue by senior management in many companies, according to the report. Some 74 percent of respondents indicated that senior management in their companies does not view access governance as a strategic security imperative. "It seems that the perception is that it's still tough to get senior executives to sign off on the necessary funding, but situations like Soci?t? G?n?rale may help prove how big of concern this really needs to be," said Ponemon.Another major contributor to the problem is the need for cross-organization collaboration, which complicates issues of access dramatically.And while 83 percent of those people responding to the survey said that collaboration among business units, audit and compliance groups, and IT security departments is vital to keeping their operations in line with government regulations, 57 percent said those teams never partner to oversee access issues."This has to be an area of great concern, because if companies consistently score poorly on compliance audits it's been proven that this actually starts to diminish their reputation and brands," Ponemon said. "And as more organizations suffer losses, there will likely be new regulations put in place that make it even harder to operate; most businesses I know don't want more regulations, but if more people fail to create their own controls, more regulators will get involved."
29086
Several security features in the Mac's new OS are incomplete, say researchers.
374369
Traditional antivirus technology may be too slow to protect users, researchers say.
623371
Despite lots of communication with investors, the Symantec-Veritas combo is still generating unease.
763575
Ilia Alshanetsky posts today about the proposed "Month of PHP bugs" that Stefan Esser is proposing:   It would be interesting to see what issues he discovers, hopefully most of them have already been reported to the PHP Security Team, in which case the upcoming 5.2.1 release will provide a resolution path for affected users.   Hopefully, as Ilia states, the bugs will not turn out to be zero-day vulnerabilities and will instead be smaller issues. Either way, a bug-fix patch will probably soon follow.   Either way, I have to look at this as a free security audit of PHP by someone with a clue about security and ultimately, in the long run it will only make PHP better, even if March is going to be rather busy.
407297
Recent changes to the security software for Windows Live has online forums buzzing with complaints from users--including onetime fans.
76275
Many security software vendors have yet to make some or all of their products available on Windows Vista, which includes new features that are complicating the task of porting the tools to the operating system.
433593
(Source: Symphoniq) You can't manage what you can't measure.  Learn why traditional performance tools can't deliver the visibility and control required to manage today's complex architectures.  Also learn about key requirements an optimal solution should provide.  View this 5-Minute solution preview.