How business learned to love open source
by Jim Carr 09-Nov-05
More and more proprietary security tools use some open-source code. What are the advantages for companies?


More and more proprietary security tools use some open-source code. What are the advantages for companies?
The biggest threat to security is not from outside, it is from the company employee. Julie Jervis asked security experts throughout the U.S. how they are educating these end-users
This has been a very good year - especially for the hackers. Ben Rothke wonders if we have learned anything from the experience
The next 12 months could be a crunch time for infosecurity. So Illena Armstrong asked some experts how the cookie might crumble
Tighter regulation and higher levels of cyber attacks will increase the role of the CSO in 2004. Marcia Savage reports
Watermarking is playing a more significant role, but is a far cry from the protection most critical data requires, says Barbara Gengler
Chris Pick outlines the pressures that are driving some organisations to integrate security and systems management
How are CSOs coping with the growing burden of software patches? Julie Jervus sought the opinions of four practitioners with strong views on the matter
Certification is just the start. Real professionals learn to share with others of like mind, says Mark Fischer
There is an increasing range of valuable qualifications that an information security expert can gain, says Marcia Savage
What can the private sector learn from the government’s ramped-up IT security? Plenty, says Jerry Harold
Security tools are important for protecting company systems, but, says Adam Lipson, focusing on people can yield better results
What is the solution to laptop loss? Software tracking, a layered approach to security, or is there another way? Illena Armstrong reports
Jonathan Gossels and Dick Mackey believe it does - the smaller the device the more likely the victim on theft
There are many damaging consequences of a poorly planned security assessment, says Gunter Ollmann.
The recent power outage was a powerful reminder of the value of business continuity provisions. Ron Mobed reports.
Buying the latest tools to secure your assets is not the way forward. A structured plan for your infosec is vital, says Illena Armstrong.
Sony’s new memory sticks have riled the business world into banning them from use, Louise Murray asks why?
New technology brings with it new problems. For mobiles devices it is security. Bob Heard looks back for answers
Security has become paramount on mobile devices as more employees work away from the office. Ron Condon investigates.
In his third article, Elton Hay discusses the problems and dangers of storing answers to challenge questions.
SSL’s potential weaknesses can be overcome says David Hicks, creating flexibility for today’s online needs.
Attacks using social engineering techniques can be difficult to defend against, as Gunter Ollmann discovers.
Illena Armstrong looks at the complex and challenging task of managing identities over today’s distributed company systems.
What does the future hold for secure virtual private networks? Illena Armstrong gazes into her crystal ball to look for the answer.
What is the future for intrusion detection and intrusion prevention systems? Illena Armstrong examines the conflicting claims.
Villain or angel? Ryon Packer explains how your network intrusion detection system could become the latter.
Gerhard Eschelbeck discovers that as malware becomes more sophisticated, your defenses must improve to prevent damage.
Malicious attacks are evolving and, as Robert Clyde discovers, defenses to these attacks should evolve too
Education should play an important part in preventing the next generation of virus writers, says Chris Belthoff.
Creating a security policy may be hard, says Illena Armstrong, but making sure that users comply is always the biggest problem
Unless C-level executives are thoroughly involved in security matters your business strategy will suffer, says James L. Bindseil
Compliance with the Sarbanes-Oxley Act is forcing companies to impose stricter policies, says Chris Mullins
Illena Armstrong looks at some of the forces driving demand for cyberliability insurance and what companies should be looking for
Both forensics and ethical hacking, says Gunter Ollmann, are needed to investigate critical security events
Security for voice networks is as vital as for data systems says Tana Scouras, but many lack even the basics
Illena Armstrong reports on a project that is seeking to develop the infosecurity professionals of tomorrow
Elton Hay spotlights the problems associated with the challenge question approach to forgotten passwords
Even the best of security policies will be ineffectual without proper implementation, says Gunter Ollmann
Applications that wait to steal your personal information are legion, so Carlos Valiente recommends constant vigilence
Tired of email porn and body enhancement offers? John Young suggests using secure content management to halt the tidal wave.
Tari Schreider describes a real-life investigation into a scam that threatened to undermine a large organization.
A new law in California means you need comprehensive incident and forensics planning says John Patzakis.
Early public key infrastructure projects failed because they were too complex. But Stephen Wilson argues that PKI is ideal for managing closed communities.
Illena Armstrong discovers that the use of traditional passwords could be giving many organizations a false sense of security.
Vital business information should be carefully stored but, Jon Tullett asks, can you be sure it really is locked away safely?
SANs have some inbuilt security says Stewart Buchanan, but this does not mean you should relax your guard
Web services may be critical for business but leave you wide open to attack. Abhishek Chauhan looks at protection techniques
Last year, says Caleb Sima, many organizations began using web application security assessment tools and discovered that many vulnerabilities could not be corrected because they resulted from insecure application development practices.
You can wander round in the dark says Gunter Ollmann, but full knowledge penetration tests are much better
Instant messaging can bring both great business benefit and far greater risks to your network systems, says John Korsak
Customers and partners need access to your systems. Roger Sullivan says XML can provide the security to make it happen.
Ray Zadjmool explores a solution to the number of false positives specifically created by the use of Windows Media Player
Recovering your laptop after it has been stolen is not as quite imposible as it might seem, as Louise Murray finds out
John Woodward contends that, by properly addressing privacy issues, a successful deployment is possible
As deployment of biometric technology becomes widespread, Illena Armstrong wonders if the interest is truly genuine.
Steven Drew and Joe Stewart argue that it is possible to be forewarned and forearmed against even sophisticated internet worms
The humble desktop is often the weakest point in workplace security, as Gunter Ollmann regularly discovers
As the HIPAA privacy compliance deadline passes, Jon Bogen highlights the top action points for the new security rules
Vulnerability assessment is a vital part of ensuring networks comply with HIPAA, says Gerhard Eschelbeck
Defending your wireless LAN may seem an impossible task, says Dave Piscitello, but you can do it more easily than you may think
Don’t overlook the importance of sound policy in your efforts to achieve effective security, says Bob Whelan
When employees of the city of Tallahassee asked for wireless access, finding a secure solution seemed almost impossible, says Curtis Franklin
Illena Armstrong asks if the big IT vendors can re-engineer themselves for security in light of today’s pressing business needs
What is most likely to bring your systems down? A minor problem might be as bad as a natural disaster argues Illena Armstrong
Terrorism gave an impetus to DR planning, says Ron Condon, but other factors have kept its importance alive
Jason Buffington looks at likely trends in disaster recovery as companies realize that availability is essential
They are the bane of administrators’ lives, but Gunter Ollmann contends that patching should be a priority.
People have different perceptions of a chief security officer role, but Illena Armstrong finds that it is a vital one for business today.
David Foote asks if businesses have got the right idea when it comes to protecting their valuable IT assets
Memories of Y2K may have faded, but, says Steve Gold, another challenge could be just around the corner.
If security is seen to enhance business goals Illena Armstrong finds that selling it to the boardroom becomes a much easier task.
Convincing management of infosec needs, says Richard O’Connor, requires amassing plenty of data first
A workable security solution, says Steve Crawford, should:
You and your boss may disagree if you’re secure, but Ryon Packer argues that you’re measuring it differently
Web services promise to change the way we build applications but, as Daniel Murton argues, security poses a huge challenge.
Firewalls are not the be-all and end-all of security, says Gunter Ollmann, and they must be managed properly
Knowing where your network is vulnerable is half the battle. Illena Armstrong looks at the need for penetration test assessments
How is the economy affecting infosec spending? Illena Armstrong discovers 2003 could see more funds allocated to security.
There is always a trade-off between security needs and economics. Richard Starnes asks how businesses can strike the right balance.
Increasingly, organizations have to comply with privacy legislation. Stuart Vaeth asks whether this is the key to improved security.
Philip Carter argues that disaster recovery and business continuity should not be too tightly regulated
Surely by now, organizations should have erected the strongest barriers to hackers. But, as Illena Armstrong and others point out, many holes remain
Some security themes keep re-occurring. Gunter Ollmann warns against one of the most common problems
What are the technologies to secure IT in 2003? Illena Armstrong asks security experts for their views
Digital attacks often mirror attacks in the real world. Illena Armstrong asks if they are inevitable and how to respond.
Both public and private sectors must work together for crisis planning and response says Richard Andrews
According to a report by Jupiter Research (July 2001 Jupiter Executive Survey), 49.5 per cent of CIOs considered the sensitivity of their company's data as 'low.’
For the person responsible for business continuity (BC), getting board-level commitment can be the biggest obstacle to creating a process to manage an ongoing program of business continuity activities.
From the early days of the Internet, credit and charge card companies recognized the enormous opportunities presented to them - but they also saw challenges ahead.
Woody Allen, that famous web services guru and comedian on the side, once described James Joyce as “the most incomprehensible and hence the finest poet of his time.”
The term ‘blended threats’ has become synonymous with viruses in the last year.
The current state of application security practice is grim.
This is the second part of a two-part article. The first part discussed security tools used to protect data integrity and the related business processes within an organization: (www.scmagazine.com/scmagazine/sc-online/2002/article/48/article.html).
Just how secure is your network?
In a post-Sept. 11 world, the security community is being asked to address a growing list of sobering scenarios that range from the newly plausible to the truly frightening.
This is the first part of a two-part article. The second part will discuss specific topics in more detail, including specific system and network security tools such as network port scanners, OS detection, configuration tools and vulnerability assessment.
What arrives in our in-boxes these days is becoming progressively richer and fatter. The content includes HTML formatted rich text, hyperlinks and attachments of various types, including Office documents, databases, images, videos, etc. It is now estimated that more than 5 per cent of emails contain images.
What is in essence a framework for designing, developing and building a new generation of applications around web standards and protocols, web services promises to make it far easier to integrate applications across disparate hardware and software platforms - a constant gripe with existing technology. Backed by all of the major IT vendors (Microsoft, IBM, Sun, Oracle, etc.), web services certainly will not suffer from a lack of effort or exposure, but will it take off and what are the issues?
It’s the 15th century, and wireless communications are flourishing. The Cardinal, Sir Dickcheney, sensing imminent invasion from the enemy, has instructed his trusted servant Walker (for centuries known only as “W”) to deliver a message to a military outpost on the remote frontiers of the kingdom, 500 miles away. “Prepare to attack.” reads the message. W’s problem: he has to get it there in 24 hours. His only option: wireless. He runs up to the tower where the master pigeon trainer, Rummy, awaits. They exchange a secret password and W hands Rummy the message. Rummy affixes the message to one of the prize pigeons and off it flies.
You wouldn't walk into a bank and find money or valuables laid out in plain view and easy to reach.
A generation ago, the world of espionage and counter-intelligence was populated by agents who operated in the shadows of eavesdropping, codes and hollowed-out books to collect and transmit important information.
For the second time in four years, the U.S. General Accounting Office reported identity theft as the fastest growing crime in America, with businesses and consumers losing billions of dollars to identity thieves.
In an effort to boost sales and generate revenue, one U.S. multinational energy company recently embraced the Internet to bolster external communication and internal collaboration.
This is the first article in a series that will look at some of the best free (and cheap) security software.
"I keep six honest serving men (They taught me all I knew); Their names are What and Why and When And How and Where and Who" (Rudyard Kipling, from ‘The Elephant’s Child’ in Just So Stories).
The scope and character of today’s computing environment is changing dramatically.
Denial-of-service (DoS) attacks just got worse - and easier! DoS is actually a grab bag of a great many techniques (such as worms and SYN flooding), all with the objective of denying legitimate clients access to services running on Internet based servers.
Is your company data an asset or a threat?
The number of technology pundits decrying the state of Internet security has reached an unbearable level.
2001 was without any doubt the year of vulnerabilities.
Information security has risen dramatically on corporate agendas since this time last year, fuelled by a combination of the terrorist activities of September 2001, the growing sophistication of malicious online attacks on businesses, and the increasing realization that unbroken network surveillance, instant intrusion detection and immediate response strategies are boardroom responsibilities.
While it makes perfect sense that the United States FBI needs a comprehensive security strategy, many companies and organizations initially did not see the need for securing their intellectual assets.
As defense counsel to a corporation or as the chief security officer, hearing such words should send immeasurable fear through the hearts of each participant at any time you are sworn in.
In this article, issues of virus naming as they impact users will be discussed, and some of the ways that naming might affect the reviewing of products will be examined.
In the traditional world, the individual moves through differing process and policy environments in which varying policies govern their interactions with others.
There has to be a better way!
At the core of decisions about Internet access, monitoring and content filtering are business policies that specify where, when and how users will access web content.
The security wars continue.
Today, hackers scan and probe sites of all sizes to find those most vulnerable to e-shoplifting, data theft or portals to access broader attacks.
Intrusion detection has become big business on the Internet and, to be honest, it's not surprising.
The "hashkeeper" paradigm or model was first introduced a number of years ago by Brian Deering of the National Drug Intelligence Center (www.hashkeeper.org).
Today's users consider email a major component of their business and personal communications, and demand the convenience of email access from any location at any time.
In May 1998, Panda Software published a press release in which I made my first public statement.
Today's content-heavy networks are transmitting richer, more critical data - and as a result, more and more enterprises are demanding quality-of-service (QoS) agreements for a higher level of network service, one that assures reliable delivery of content along with consistent availability of bandwidth.
While Internet security has always been important, only recently has it emerged as an important issue for almost all who use the Internet.
Network security can be complex.
Best practice (ISO 17799) advocates the development of information security policies to ensure the confidentiality, integrity and availability of information.
The denial-of-service (DoS) attack is a common, recurring problem in networking, and recently, more and more companies are being caught out because of holes in their security infrastructure.
Laws giving digital signatures legal legitimacy have been enacted around the world.
They may not have as many employees, generate the same size revenues or have the million-plus customer base of the large enterprises, but when it comes to Internet security, small and medium-sized businesses (SMEs) face exactly the same risks as larger organizations when they incorporate e-business and e-commerce into their traditional business models.
In the aftermath of the September 11 terrorist events in the United States, the fear that malevolent hackers and other criminal perpetrators might unleash a cyberattack on the Internet is becoming an increasing concern.
In the last few months, debate over the ethics of disclosing details of vulnerabilities has been rekindled.
Companies are under more pressure than ever before to ensure that when it comes to protecting their lifeblood - their critical corporate data - no protection can be too much.
Interest in security is at an all-time high. How can we best secure our possessions, our information, even ourselves?
Microsoft's Windows XP operating system has arrived amid a multi-million dollar worldwide marketing fanfare the like of which we rarely see.
Various iterations of the Nimda virus have slowed its propagation around the world after causing havoc on resource-constrained IT organizations.
The events of September 11 have made security a national priority in the USA.
Historically, corporations and solution providers have taken a medieval, provincial approach to keeping data secure.
Due to the abundance of Internet security attacks, the news over the past year has been flooded with warnings and reports of numerous network vulnerabilities.
By now, it's obvious that the economy and the technology sector in particular, are in the midst of a significant downturn. But hand-wringing over ever-dropping stock prices, new rounds of lay-offs and lowered earnings do not constitute a strategy.
Today's security measures are not keeping up with today's security risks.