IT-Toolkits.com

Security at What Cost?

webmaster — Fri, 27 Jun 2008 16:28:11 -0600

Electronic Frontier Foundation and Asian Law Caucus, two civil liberties groups in San Francisco, filed a lawsuit to force the government to disclose its policies on border searches, including which rules govern the seizing and copying of the contents of electronic devices. They also want to know the boundaries for asking travelers about their political views, religious practices and other activities potentially protected by the First Amendment. The question of whether border agents have a right to search electronic devices at all without suspicion of a crime is already under review in the federal courts.

The lawsuit was inspired by some two dozen cases, 15 of which involved searches of cellphones, laptops, MP3 players and other electronics. Almost all involved travelers of Muslim, Middle Eastern or South Asian background, many of whom said they are concerned they were singled out because of racial or religious profiling.

Most Data Breaches Caused By IT Administrators and Business Partners

webmaster — Mon, 23 Jun 2008 15:25:51 -0600

Inside security breaches create more security violations than those of outsiders say a security breach analysis study published by a major telephone carries.

External breaches pose the greatest threat (73%), but achieved the least impact (30,000 compromised records
Insiders breaches pose the least threat (18%), and achieved the greatest impact (375,000 compromised records - plus 50% of these are as a result of IT Administrators
Business partner breaches posed a mid-sized threat (39%) but compromised 187,500

While these are rudimentary numbers, the relative risk scores are reasonable and discernable. It is also worth noting that the business partner numbers rose over the duration of the study, making partner crime the leading factor in breaches. This is likely due to the ever increasing number of partner connections businesses are establishing, while doing little to nothing to increase their ability to monitor or control their partner's security posture.

87% of Data Breaches are Avoidable Says Verizon

webmaster — Wed, 11 Jun 2008 10:02:00 -0600

Data breaches are a fact of life with the advance of Wi-Fi, 3G, and remote computing as it is done in todays flexible business environment.

Data breaches and network intrusions occur because the personal information compromised includes data elements useful to identity thieves, such as Social Security numbers, account numbers, and driver's license numbers. Some breaches do not expose such sensitive information; however, they still expose individuals to identity theft and business to a compromise of their electronic assets and that must be disclosed under Sarbanes-Oxley and various state laws.

According to Verizon, nearly nine in 10 corporate data breaches could have been prevented had reasonable security measures been in place.

The Verizon "2008 Data Breach Investigations Report" spans four years and more than 500 forensic investigations involving 230 million records, and analyzes hundreds of corporate breaches including three of the five largest ones ever reported.

They found that 73 percent of breaches resulted from external sources versus 18 percent from insider threats, and most breaches resulted from a combination of events rather than a single hack or intrusion.

Recommendations for Enterprises

Simple actions, when done diligently and continually, can reap big benefits, the study notes. Key recommendations include:

Align process with policy. In 59 percent of data breaches, the organization had security policies and procedures established for the system, but these measures were never implemented. Implement, implement, implement.
Create a data retention plan. With 66 percent of all breaches involving data that a company did not even know was on their system, its critical that an organization knows were data flows and where it resides. Identify data and prioritize its risk to the organization.
Control data with transaction zones. Investigators concluded that network segmentation can help prevent, or at least partially mitigate, an attack. In other words, wall off data when and where appropriate.
Monitor event logs. Evidence of events leading up to 82 percent of data breaches was available to the organization prior to actual compromise. Data logs should be continually and systemically monitored and responded to when events are discovered.
Create an incident response plan. If and when a breach is suspected, the organization must be ready to respond, not only to stop the data compromise but to collect evidence that enables the business to pursue prosecution when necessary.
Increase awareness. Only 14 percent of data breaches were discovered by employees of the victimized organization, even though employees are the first line of defense in safeguarding data. Educate them to be aware.
Engage in mock-incident testing: Making sure employees are well-trained to respond to a breach. Run drills and test peoples abilities, judgements and actions during a mock crisis.

A complete copy of the "2008 Data Breach Investigations Report" is available at http://www.verizonbusiness.com/resources/security/databreachreport.pdf.

ID Theft By Those Close To You

webmaster — Tue, 03 Jun 2008 09:55:03 -0600

ID Theft is not just by strangers in Eastern European countries. A recent arrest shows how an Ivy League economics graduate and his girl friend who looked like the Mr. and Mrs. American couple stole the identities of friends, co-workers and neighbors.

They enjoyed an luxurious life style that included trips to the Caribbean, Hawaii, and Europe. In a very brief period they stole over $115,000 and were in process of trying to steal over $120,000 when they were arrested.

They used simple techniques like breaking into apartment to get information on neighbors, dumpster diving, and getting mail box keys for their apartment complex. They applied for credit cards and then intercepting the cards when they arrived via the mail. They also had fake drivers licenses and an industrial machine that made identity cards.

Free Wi-Fi May Become a Reality

webmaster — Thu, 29 May 2008 15:08:36 -0600

The U.S. Federal Communications Commission (FCC) plans to vote on a program to auction a "Free WiFi" spectrum.

The winner of the 25Mhz piece of spectrum in the 2155MHz band would be required to deliver free wifi Internet access. The operator could choose to use any technology, but in that range, WiMax or many of the mobile technologies would make sense.

The FCC believes this is a good idea and demonstrates the FCC's commitment to supporting initiatives that have a positive impact on the next phase of broadband innovation. This will give consumers greater choices to access the Internet said a FCC spokesperson.

The FCC has developed the plan based on proposals from several companies. In 2006 one company proposed that the FCC give the company the spectrum so that it could offer free wireless Internet access to users. The company planned to fund the network through advertising and said that it would give the FCC 5 percent of its gross revenue. The FCC's current proposal would simply auction the spectrum to the highest bidder and require the free services.

The current proposal also includes a requirement for a content filter that would aim to prevent minors from accessing adult content over the free network. The final plan could also include specified data rates for the free service.

Data Breach and Network Intrusion Tools Released by IT Toolkits.com

webmaster — Mon, 26 May 2008 12:40:40 -0600

Janco has defined a set of tools which enterprises of all sizes can use to be prepared to protect against breaches and intrusion, know when it occurs, and provides the ability to respond quickly when it does happen.

The Data Breach and Network Intrusion Detection Tools are the tools that are needed and contain:

Security Manual Template
Security Audit Program
Network Event Viewer
Smart Disk Monitor
Text Log Monitor
Internet Service Monitor

US Tax Court Warns of Phishing Attack

webmaster — Sat, 24 May 2008 08:13:36 -0600

The US Tax Court has posted a warning on its site about a Spear Phishing attack. The site says:

The United States Tax Court has received many telephone calls regarding an e-mail which purports to originate from the Court being sent by a member of the Tax Court's practitioner bar. This message is an example of Spear Phishing, which is an e-mail spoofing attempt that targets a specific organization. The Tax Court is not disseminating any e-mail notice to anyone who currently has a case before this Court. If you receive an e-mail with a subject line that includes the text, Notice of Deficiency # followed by a series of numbers or US Tax Petition, along with a malformed docket number following the format #000-000, and a sender address of noreply@ustaxcourt.org, complaints@ustaxcourt.org, or notice@ustaxcourt.org, please ignore/delete the e-mail and do not click any link within the e-mail message.

Merger of HP and EDS Will Eliminate Thousands of Jobs in India

webmaster — Wed, 14 May 2008 10:24:24 -0600

With the acquisition of EDS by HP there will be a reduction in the number of IT service jobs. That will have a large impact on Outsources. There are over 137,000 EDS jobs, with almost 25,000 in India, and many of those jobs will be eliminated in a consolidation and automation of the combined companies data centers.

The elimination of jobs will put more pressure on outsource providers as there will be a surplus of employees who will be out of work.

In the 1970s that occurred in the US and that drove a recession. The question is will that be good for the US job market or not. Only time will tell.

Encryption is a must to meet mandated requirement

webmaster — Sat, 10 May 2008 03:46:02 -0600

The California privacy protection act, SB 1386, which is a model for many states including New York, exempts companies that can prove lost data was encrypted from the requirement that they notify consumers. When mobile data is encrypted, thieves hoping for gold bars of valuable data are left instead with a solid, impenetrable and useless brick.

When protecting data on mobile computers, companies have two primary choices:

File and Folder Encryption: This type of technology allows users to encrypt sensitive files themselves.
Whole-Disk Encryption (Full-Disk Encryption): Centrally managed, this process relies on software and hardware products.

Over 25% of All Enterprises Faced a Disaster in the Last 5 Years

webmaster — Fri, 02 May 2008 16:37:03 -0600

Janco has found that more than a 26% of its client firms have faced some sort of a disaster over the past five years. CIOs need to convince executives in their enterprise to invest in business continuity and disaster recovery systems. CIO need to effectively communicate that business continuity and disaster recovery planning is not just an insurance policy.

CIOs know their systems are vulnerable and they want to do something about it. In these tough economic times, it is hard to get funding for business continuity and disaster recovery. CIOs who tie business continuity and disaster recovery planning to mandated compliance needs are more successful in obtaining the necessary funding.

Many of these same companies consider disaster recovery investment as a rolling upgrade that consistently augments existing infrastructure and application investments rather than a one-time event that can be delayed.

In one research study by another firm many CIOs blamed disasters on non-natural disruptions and incidents. The data shows that 42% of the firms surveyed said power failure was the most common cause of declared disasters and downtime, while 32% cited hardware failure, and 21% cited network failure.

LoJack for Laptop Systems Soon to be a Reality

webmaster — Thu, 01 May 2008 15:31:38 -0600

Absolute Software Corporation is collaborating with Intel to integrate its Computrace asset management, data protection, and theft recovery technology and services into Intel's Anti-Theft Technology (ATT). The technology will be a key component of Intels Anti-Theft Technology (ATT) to be delivered on the upcoming Centrino processor platform later this year.

Absolute is known for its Computrace LoJack for Laptop system, which is currently available and has been responsible for the recovery of over 6,000 stolen notebook computers, including Macs, since it debuted. Additional products in the Computrace family can add comprehensive laptop management features such as IT asset management, remote data delete and software license management.

For more than a decade, Absolute Software has single-handedly created and developed the market for BIOS-persistent, Internet-based tracking of mobile computers. Computrace is also capable of remotely deleting data and physically recovering lost or stolen computers -- assisting customers in complying with data privacy regulations, said the CEO of Absolute Software.

Since IBM in the 60s Vendor Have Helped to Recruit Staff for Customers

webmaster — Fri, 25 Apr 2008 10:02:22 -0600

Many vendors offer free headhunting services to customers, fulfilling what is often an acute need. They achieve two goals with that effort: first they do a favor for both the customer and the employee who is hired; and second they have some in the employ of their customer who will not be reluctant to push some business their way.

A small group of solution providers in recent years has started a for fee headhunting serivice. Though playing headhunter was not exactly in their original business plans, these solution providers have tackled recruitment as another service for their customers.

What is the True Cost of Data Loss

webmaster — Mon, 21 Apr 2008 09:08:58 -0600

(Symantec) Information drives a business. The success and viability of that information hinge on an administrators ability to protect its integrity while keeping it available throughout the enterprise at all times. However, the exponential growth rate of data volumes; shrinking backup windows; the demand for more effective change management; and the need for fast, reliable recovery create stiff challenges for disaster recovery efforts. Todays solutions must offer best-of-breed data protection and system recovery. An essential part of such a solution is granular data protection. Businesses cannot afford to waste valuable time and resources restoring a complete data volume or database when all a user needs is a single file or email message.

To calculate the annual loss expectancy (ALE) of an asset, you use the quantitative risk analysis method. This calculation is determined by first figuring the annual ra te of occurrence (ARO) and the single loss expectancy (SLE).

Once those values are known, ARO x SLE = ALE. Suppose the SLE is US$35,000, and the ARO is 12 (i.e., the cost of the server being down for a day is US$35,000, and this attack happens once every month). In this example, US$35,000 x 12 = US$420,000 per machine.

To protect your financial viability, you need to be able to perform data restoration and bare metal system recoveries more efficiently and faster than ever.

With Continuous Data Protection added to your data protection efforts, you can take advantage of application data protection in remote offices while reducing costs and minimizing the IT workload. Continuous Data Protection helps eliminate the hassle and expense of tape-based backups at remote sites by replicating data from remote office servers to a central location at the corporate office, where data can be reliably backed up and stored. Centralizing backups minimizes the costs associated with hardware, media, and administration investments at remote offices.

Many are not ready for VoIP

webmaster — Thu, 17 Apr 2008 15:09:37 -0600

Its safe to say Internet Protocol (IP) telephony has arrived as a feasible communications technology for business. And for good reason. Now that the telecom industry has had time to refine it and more organizations are deploying it, IP telephony is delivering on its claims of reducing calling costs, simplifying administration, and providing greater communications flexibility with software applications taking the place of traditional hardware systems. IT chiefs and corporate level decision-makers also are looking more closely at IP telephony as voice quality continues to improve, and as organizations that use IP continue to consistently reach the Five 9s level of reliability with 99.999% system uptimes.

But perhaps the most compelling argument for implementing IP telephony is that Private Branch Exchange (PBX) telephone systems the systems the business world has used the last 30+ years to generate calls are expected to be near extinction by year-end 2008. Gartner, Synergy, Forrester and other industry analysts made that prediction as early as 2003, and their collective forecast is coming true as a number of PBX manufacturers announce plans to cease development and support of their PBX products. IP telephony, after all, is forcing their hand. Compared to IPs standards-based software approach and ability to converge voice on a data network, traditional proprietary PBX systems are more difficult to integrate with an organizations business applications and business rules, and have increasingly become more expensive to maintain or update.

Wireless policy is critical to meet mandated requirements

webmaster — Sun, 13 Apr 2008 17:32:33 -0600

Wireless security is critically important. If the wireless device of an executive slipped out of his briefcase while in a taxi cab, all of your critical data and statistics could be exposed.

With wireless security, a single point of control is needed so IT can manage how users interact with your systems. This point of control must sit behind the corporate firewall. Make sure you have the ability to mandate passwords for users, the ability to wipe data from the device remotely, as well as the ability to lock the device remotely. Being able to establish settings through policies or parameters and providing robust control across all devices is extremely important to corporate security.

End-to-end security is a top priority for most companies and government organizations. IT departments also need to be concerned about exposure to viruses, denial of service attacks and malware. Organizations need to ensure that their wireless platform meets appropriate standards to protect their corporate systems and data.

All transmissions from the wireless device to servers behind the corporate firewall should be secure from end to end. Think about confidentiality, integrity and authenticity. Confidentiality is typically achieved using advanced encryption. Integrity ensures a message has not been tampered within transit. Authenticity allows the recipient to identify the sender and trust that the sender actually sent the message.

For additional application security, features such as code-signing can ensure that every application loaded onto a device is tied to an author, which locks out potentially malicious or unauthorized applications. System administrators, once again, should be able to maintain control by setting an IT policy that blocks third-party applications from being loaded on the handheld.

What security threats do businesses face today

webmaster — Thu, 03 Apr 2008 15:30:49 -0600

From spyware and phishing to intrusion attempts, the threats attacking computer networks are more dangerous than ever. Many threats are targeting specific industries with convincing-looking e-mail and phone calls. The hackers hope to direct employees to counterfeit Web sites, in order to harvest passwords and private financial information or steal computer and network resources. Some analysts now say that the revenue from cybercrime in the United States now exceeds that of illegal drug activity.

There is a change in the threat landscape, before they were noisy and targeting the perimeter of the network, now they are becoming much more silent, difficult to detect and highly targeted,.

Many attacks are targeting Web browsers and the client applications on the computer itself. And while a small business network may not be as complicated as an enterprise network, they still have desktop and mobile clients.

Because small businesses have fewer IT resources at their disposal, they need solutions that provide comparable protection, at affordable costs and requiring minimal administration.

What are the advantages of VoIP for enterprises with PBxs?

webmaster — Fri, 28 Mar 2008 12:57:53 -0600

What are the advantages of VoIP for enterprises with PBxs?

	Traditional	VoIP
Conference Calls	Special equipment is required for more than three people	Easily conference large numbers
Mobility	Very difficult to set remote users up in systems if they are local	Easily add remote users of any kind
Phones	Can only provide traditional phone services, albeit complex ones	Can be programmed to provide internal and external apps of all kinds
Efficiency	Dedicated voice lines provide known quality levels but no flexibility	More efficient use of network

Web 2.0 is a Security Nightmare for Many

webmaster — Tue, 25 Mar 2008 14:42:29 -0600

CIOs and IT managers are excited about leveraging Web 2.0 technologieswikis, blogs, content tagging, and social networks, for exampleto drive collaboration, improve knowledge management, and spur innovation. But Web 2.0 comes with a raft of security vulnerabilities, and the fallout from data theft and network compromises can be devastating.

Why is Web 2.0 so dangerous? Because it opens corporate applications to user contributions via the Internet, and thats where hackers and thieves are waiting to launch their attacks.

Download the complimentary white paper, Web 2.0: Worth the Risk? to learn how malware can turn your Web 2.0 implementation into a liability, and about how hackers exploit new threats to:

Compromise individual PCs
Compromise Web sites
Steal data
Gain control of Web-based management consoles
Misappropriate corporate data

Help Desk and service requests better served by Internet based support

webmaster — Thu, 20 Mar 2008 14:02:35 -0600

Centralization was the first great innovation of technical support. As mainframes with their dedicated cadre of IT professionals increasingly gave way to the widespread deployment of complex software running on a broad array of off-the-shelf hardware, on-site support with local help desks was no longer practical. But in the process, something important was lost. Field service technicians were with the equipment, but User Help desks in remote centers had to work through customer intermediaries. While some of these customers were quite skilled, it was never quite the same as working on the systems in person. Resolutions simply took longer. Stopgap measures evolved, but are cumbersome, often less secure, and dont scale across todays heterogeneous, many-to-many Internet environment.

Internet-Based Support to the Rescue

In recent years, support centers have discovered and adopted a new breed of remote support. It provides the next best thing to being there in person, letting User Help Desks virtually sit next to customers, see what is on their screens, and take over if appropriate. They make it easy to upload and download files to diagnose and resolve issues. And their architecture lets them do this in a way that is secure, under the customers control, fast, and scalable. They do not require time-consuming or undesired software installations on the customer machine. Setting up a connection is fast, no matter how the computers are connected to the Internet.

The results have been dramatic:

Faster time to resolution, as phone tag and data gathering steps are eliminated, and more issues are resolved at first contact.
Higher TSR productivity, as support engineers can work directly on the system, and see exactly what is happening without needing to recreate customer environments on lab computers.
Better root cause analysis, as engineers can see defects exactly as they present themselves at customer sites.
Training as a byproduct of support, as the customers watches, learns, and duplicates expert resolution processes.
New tools for workforce monitoring and coaching as Quality Assurance teams can review remote session recordings.
Higher customer satisfaction and loyalty as a natural side effect of faster, more accurate, and more transparent resolutions.

Disaster Planning and Server Consolidation

webmaster — Sat, 15 Mar 2008 14:49:35 -0600

The cutting edge of virtualization technology may have set its sights on virtual PCs, unified network fabrics and other esoteric applications, but server consolidation remains the primary driver for most data centers. In fact, only a handful of enterprises have begun the process of virtualizing their server farms, according to most recent surveys, although the pace is likely to pick up as energy costs and competitive pressures drive organizations to increase performance even while paring down their hardware infrastructures. But as those who have already taken the virtual plunge have no doubt realized, consolidating servers is not just a matter of powering up the virtualization layer and then pulling equipment out of racks. There is a long list of factors to consider with any centralization project and a wide range of land mines that need to be avoided to prevent service failures. One of the main concerns is the resiliency of remaining hardware.

Electronic Banking is Not as Safe as You Think

webmaster — Wed, 05 Mar 2008 13:43:17 -0600

Customers of HSBC, Bank of America and Washington Mutual may want to think twice about banking online. Quickly. The three banks are identified in a study by a UC Berkeley's Boalt School of Law researcher as the most victimized by identity theft. Researcher Chris Hoofnagle used numbers received under a Freedom of Information Act request. He ran the numbers from three randomly chosen months in 2006.

The results were that HSBC had 21 incidents per billion of dollars on deposit, BoA had 17 and WaMu 16. ING was the most secure, with a lone incident per billion on deposit, the study said. The findings dovetail with a 2007 report from Cambridge University that said BoA and WaMu phishing sites usually stayed afloat for more than 100 hours, while Chase and PayPal general got such sites taken down in less than two days.

PCI Compliance Leaves Consumers at Risk

webmaster — Sun, 02 Mar 2008 15:43:06 -0600

PCI Merchant Compliance is spotty with smaller merchants. According to Visa and CyberTrust there is a long way to go before customer data is protect from identity theft exposures. Compliance is shown in the table below.

*Level*	*Transaction Volume*	*Number of Companies*	*Percent PCI Compliant*	*Percent Working Towards Compliance*	*Percent Just Beginning the Process*
1	6,000,000 plus	326	77%	23%	O%
2	1,000,000 to 6,000,000	709	62%	30%	8%
3	20,000 to 1,000,000	2,596	54%	20%	25%
4	Less than 20,000	200,000 plus	Unknown	Unknown	Unknown

Over 46,000 Identity Theft Incidents Reported to the FCC in Three Months

webmaster — Thu, 28 Feb 2008 12:12:36 -0600

The Berkeley Center for Law and Technology issued a report measuring identity theft at top bank in the United States. The report concluded that identity theft is a major issue. In a three month period of 2006 they found there were over 46,000 incidents reported to FCC.

The top 20 insttitutions are a combination of Banks, Telephone (Cellular) companies, Credit Card issuers, and consumer retail firms.

Institution	Identify Theft Incidents
Bank of America / MBNA	3,351
AT&T / Cingular / SBC	2,290
Sprint / Nextel	2,095
JP Morgan / Chase / Bank One	1,839
Capital One	1,328
CitiBank	1,240
Verizon	932
American Express	910
Washinton Mutual / Providian	885
Well Fargo	788
Tmobile	706
Discover	667
Target	660
Sears	601
Dish Network	575
HSBC	571
WalMart	500
Dell Computer	481
Wachovia	441
AFNI	395