Measure, control and improve IT security

For fear of becomming the next victim of identity theft, 150 million U.S. consumers don’t bank online, according to experts. But the banking industry could improve profitability by as much as $8.3 billion per year if banks build consumers’ confidence in online security, according to the TriCipher Consumer Online Banking Study.

The study, which was based on online survey responses from 3,349 U.S. adult consumers, reports that 31 million customers would feel safe enough to begin banking online and another 39 million online users would increase their online banking activity if their banks offered free identity protection software.

While only 6 percent of survey respondents have been victims of identity theft or fraud, 41 percent — which translates to more than 88 million U.S. online banking customers — would change banks or reduce their online service usage if their individual institution was compromised by a data breach, the study says, making identity protection a significant competitive differentiator.

Consumers are willing to take extra steps to protect their identities, but they do not want to pay extra for these services. “Many view this as a service they should get automatically,” explains Stephen Knighten, statistical analyst, Javelin. “They are willing to take extra steps, but not at an expense.”

According to the study, 62 percent of online banking users would download and use identity protection software if their banks provided it for free. Consumers are interested in second-factor solutions, including biometrics (33 percent), one-time password tokens (20 percent) and peripheral device recognition solutions (15 percent). “The key to these solutions’ success,” says Knighten, “is that they must be convenient.”

While banks must foot the bill for these security measures, they can recover their investments by cross-selling to the lucrative online banking segment, notes TriCipher’s DeSantis. “Banks can target them with profitable lines of credit, mortgages and similar products,” he says. “The key is to reinforce trust and loyalty of account holders. … Unless you have their confidence, they will start to stray.”

See full story.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

Oracle is suing SAP in federal court, alleging that its chief competitor in business software markets has been stealing corporate secrets. SAP is still reviewing the suit.

Concerns over sabotage or theft are on the rise, prompting companies of all sizes and including utilities to examine their policies and business processes. Because utilities are geographically dispersed and have thousands of employees, breakdowns in security will inevitably occur. The goal then is to mitigate that threat on the front end and if espionage has taken place, perpetrators should be tracked down and held responsible.

According to the FBI, corporate espionage costs U.S. companies between $24 billion and $100 billion annually. Interestingly, only about 20 percent of those losses are tied to cyber threats while the majority of them are associated with low-tech schemes such as stealing from trashcans.

It’s not just big business that is at risk. It can also be the smaller engineering, environmental and law firms. Most corporate crooks can’t break into computer systems. But, they can meander into open offices, taking phone numbers, strategy bulletins and computer info.

“A good spy always looks for the path of least resistance before trying anything fancy or high tech,” says Ira Winkler, an information-security-systems consultant, in a book called Corporate Espionage. “In fact, small businesses tend to be targets more often than large corporations, simply because they have more competitors.”

Beyond cyber threats, companies must keep classified information restricted while requiring employees to sign agreements prohibiting the unlawful use of company trade secrets. Those secrets may include anything that a company knows that is unknown in the marketplace, which gives it an uncommon competitive advantage.

Corporate espionage is a risk for all companies. Utilities are clearly aware of the problem. As a result, their information technology units are now working hand-in-hand with upper management to guard the integrity of the business lines. It’s a sensible solution to what could be a potentially devastating issue.

See full story by Ken Silverstein.

See the latest on Oracle’s SAP lawsuit at PCWorld.com.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

Imagine all of your network and security devices working as a unit to enforce security policy. That’s the vision of “cooperative policy enforcement,” an emerging concept being promoted by Aventail.

While network admission control (NAC) is emerging and there are many different policy enforcement tools available, there still isn’t a common, coordinated structure for enforcing policy across all devices. Chris Hopen, CTO of Aventail, says the key is having a broader policy that aggregates the traditionally separate policies of firewalls, routers, switches, VPN gateways, and NAC boxes.

Some industry analysts consider cooperative policy a natural progression. “Cooperative policy has to happen. It’s not even a question of if, but of when. You have many network assets as an organization — firewalls, routers, switches, VPN gateways — and each of those should be able to enforce policy, not just any one,” says Robert Whiteley, senior analyst for enterprise networking at Forrester Research. “Most NAC products make you choose one of those” to do enforcement, he says.

With cooperative policy enforcement, the policy servers on each security device can share security problems they find and take action to fix them, he says. When an IPS sitting behind the VPN gateway detects a problem, for instance, it can work with the gateway to pinpoint the source: “So when the IPS raises an event and says here’s malicious traffic, that device can then make a SOAP call back to us, query us, and say ‘what user is responsible for injecting this traffic into the network?’”

Then the offending user could automatically be blocked from the network or certain service. “This is beyond reporting and more about taking action,” he says. “Today devices do not allow any visibility into their policy decisions, let alone providing a mechanism for allowing another network device to control or dictate changes to the policy behavior.”

See full story.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

IDC research finds that enterprise companies rank insider sources as their top security threat.

In addition, research from Carnegie Mellon University for the Department of Defense (DoD) finds that when it comes to insider attacks, 86 percent of perpetrators held technical positions. Of these, 57 percent performed the attack after termination.

Both reports found that insider attacks result in costly outages, lost business, legal liability and, inevitably, failed audits. In one case study, it took 115 employees 1,800 hours to restore data deleted by a disgruntled insider. At the time of the attack, the perpetrator was an ex-employee of the IT department who was able to remotely access key systems. According to these reports, IT insiders commonly acquire and maintain powerful system access using privileged accounts and passwords even after termination.

Here are six of the best practices recommended by Calum MacLeod (European director, Cyber-Ark Software) to battle insider menace:

1: Create an inventory of privileged (non-personal) passwords

2: Define the role of identity and access management (IAM)

3: Apply change policies to privileged passwords

4. Make sure privileged passwords are stored securely

5. Create a staged approach to deployment

6: Remember computers are people, too

See full story.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

SupportSoft Inc. analyzed about 2 million IT help desk calls from 20 large companies (average workforce: 75,000 employees). James Morehead, vice president of product management and marketing at the Redwood City, Calif.-based vendor, says the result is his company’s Headache Index of the most common problems end users thrust upon IT support operations.

Yes, password issues top the list, with 20% of all calls involving a variation on the phrase, “I forgot my password.” While you’ve no doubt already automated the response to that one, other problems probably lack automated fixes. Morehead thinks you should consider help desk automation for any problem that accounts for 3% or more of all calls. Take e-mail issues, which came in fifth on the Headache Index, chalking up an 11% share of help desk calls. Morehead points to Outlook’s OST (offline storage) file as one likely suspect. It’s regularly overstuffed, which can cause Outlook to sputter and fail.

And he says a lot of home PC users are contacting his company’s recently unveiled consumer help desk site, www.support.com, to express frustration with Microsoft Corp.’s new Vista operating system. “We’re learning now to help IT later,” Morehead says. Of course, when you roll out Vista, you might want to keep a bottle of aspirin handy just in case.

See full story.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

According to the recent article by Dan Morrill, “Google Desktop Applications, or Google Apps is a risky decision to be making, small company or big company it does not matter”.

Information Security - Google has a lot of money to spend on information security, but Google also has a track record like every other software maker, of having code with bugs. If you use Google apps, you have to trust their code over the internet, and you have to trust them to patch their code in a timely manner.

Legal Discovery – so far the law has worked in this fashion, ISP or Company gets a discovery notice, the ISP or Company is not obligated to inform you, rather they usually make a copy of all the data and send it to the legal group requesting the information. Since all your data is hosted outside the company on a 3rd party server system, ownership is most likely not going to be efficiently defined until there is a series of lawsuits to determine who owns information on 3rd party service providers. Technically, it should already all belong to Google.

Control – usually when working with technology and 3rd party outsource, only “authorized” people are allowed to call for support. Control of the help desk, and the services that the help desk provides for lost information, e-mail support, password reset support, and other low level support functions are now being taken over by Google.

Other Legalities – Have you engaged legal counsel before signing up? This is a big one, what do the company lawyers say about the issue? Will they be involved in the decision, and will management listen to what legal counsel is saying, and what the legal liabilities are.

Federal/State Mandates – if you are covered under HIPAA, SOX, GLB, HB1386, or otherwise, how does using Google Apps help you gain compliance, or remain in compliance if you use their system? From the legal mandates and laws side, unless Google can provide a statement of compliance that will stand up in court, anyone who is under any federal or state law for information security compliance might want to think twice before using this service.

Think long and hard before using Google Apps, make sure there are legal protections and someone can not just randomly request data without talking to legal council first. Make sure that the bases are covered, and if you are in a regulated industry that you get a certificate of compliance from Google. Otherwise, there is a ton of free or low cost software out there that will allow you to do the same things, do them in an equal or like manner.

See full story.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

An adviser to the UK Cabinet warns that civil servants’ low awareness of data security threats puts information collected by the government at risk.

A key advisor to the Cabinet Office on information assurance issues, said that with the exception of the police, defence and intelligence communities, public servants have little grasp of information security threats. “What keeps me awake at night is that, with some notable exceptions, across government there’s too little awareness of the scale and breadth of the risk facing us at the moment,” he said.

Ignorance of information security threats at board level is actually more of a threat than the threats themselves, according to Burton. “No-one knows the scale of the risk. We need to energise boards. The technical risks are nothing compared with ignorance at board level,” he said in a panel discussion at a British Computer Society (BCS) security event this week.

The UK government recently announced two sets of controversial plans around data use – plans to form the database for the ID Cards National Identity Register from three existing databases, and plans to relax data-sharing laws so government departments can share information more easily.

See full story.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

AKS-Labs has released a Windows privacy utility called RecentCleaner. With RecentCleaner one can check and clear the list of recently opened files. Recent files is a kind of link that program creates when the file is being opened. Almost all products create recently files, for instance Microsoft Word, Excel, PowerPoint, Access, WinZip, WinRar. Windows system keeps the record of recently accessed files too.

Sometime the list of recently opened files can become a great security problem, as it hard to remove all these records fast. RecentCleaner was created to solve this issue in a timely manner. Recent files records can be cleared in a single click now.

Learn more about clearing recent files at RecentCleaner web-site.

AKS-Labs has released a version 1.0 of RecentCleaner, a personal privacy tool designed to browse and clean recently accessed files list. The program supports WinZip, WinRar, Word, Excel, PowerPoint, Windows recent files.

Learn more about clearing recent files.

Amid warnings about the risk of identity theft, Canadian insurance companies have begun offering policies that help defray the cost of setting things right, if you fall victim.

Identity theft occurs when a crook uses another person’s name and other personal information such as social insurance number, credit-card number or bank account illegally to make purchases, borrow money or make some other costly transactions without the victim’s consent or even knowledge.

According to research by Phonebusters, a national anti-fraud organization…, thousands of Canadians a year report cases of identity theft — although the rate may be lower now than it was a few years ago.

It can be time-consuming and costly for innocent victims of identity theft to compile the information and get the legal advice required to verify they aren’t at fault. It’s those expenses — such as lost wages, lawyer and notary fees and courier charges — that are covered by identity theft insurance.

“Those are where the real expenses come in. It’s not the $5,000 or $10,000 loan. It’s the expense of clearing everything up,” says Bryan Seaton, spokesman for ING Canada, which recently began offering identity theft protection across Canada.

There has been increased public awareness of the measures — such as shredding documents with account numbers, proper storage of passwords and account numbers and software protections for your computer — that can be taken to prevent your personal information from getting into the wrong hands.

“We have a duty to defend your title. So we do what we can to get it resolved. Or, in a worst-case scenario, we can pay out the money that you’ve lost as a result of this problem,” says Kathleen Waters, vice-president of Title Plus, a service provided by Lawyers’ Professional Indemnity Co.

See full story.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.