New Technology Reviews!.: Security

Windows 8 Branded PCs Could Prevent Other Operating Systems From Being Installed

<div dir="ltr" style="text-align: left;" trbidi="on">
<span class="Apple-style-span" style="font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 14px; line-height: 19px;"></span><br />
<img alt="windows 8 limitations" class="aligncenter" data-mce-src="http://www.new-technology-news.net/wp-content/uploads/2011/10/9fdff3b6ade-boot.jpg.jpg" src="http://www.new-technology-news.net/wp-content/uploads/2011/10/9fdff3b6ade-boot.jpg.jpg" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px; display: block; margin-left: auto; margin-right: auto;" />“Secure Boot” is a new Windows 8 technology that’s required of OEM computers if they are to feature the Windows 8 Compatibility Logo. It’s designed to protect against malware at the boot level by preventing ‘unauthorised’ code from launching during system boot. However it’s been revealed that it may also prevent non Windows 8 operating systems – such as Linux – from being able to install or run.<br />
<h2 style="font-size: 1.5em;">
How Does It Work?</h2>
Newer PCs are increasingly using a replacement for the old BIOS called UEFI (Unified Extensible Firmware Interface). It’s a technology that’s been built into Apple Macs for years now, but basically it allows for faster boot and more efficient hardware access by the operating system. It’s also the main reason OSX is difficult to install on PCs, so if you have any hackintosh experience you’ll know about having to run an EFI emulation.<br />
The UEFI specification contains a firmware validation method, which works by defining certificate keys for which boot code is ‘secure’ and therefore allowed to run during boot. Microsoft supplies these keys to manufacturers, who include it on their machines, and only boot code which has a corresponding secure key is allowed to boot.<br />
<img alt="windows 8 limitations" data-mce-src="http://www.new-technology-news.net/wp-content/uploads/2011/10/1c693b7d3dbios.png.png" height="123" src="http://www.new-technology-news.net/wp-content/uploads/2011/10/1c693b7d3dbios.png.png" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px;" width="560" /><br />
<img alt="windows 8 blocks linux" data-mce-src="http://www.new-technology-news.net/wp-content/uploads/2011/10/fdd58474e1uefi.png.png" height="163" src="http://www.new-technology-news.net/wp-content/uploads/2011/10/fdd58474e1uefi.png.png" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px;" width="560" /><br />
Basically this prevents malware from launching at a boot level, so it’s potentially mitigated a large number of security threats. The problem with malware that runs at the boot level is that it’s very difficult for regular anti-malware to protect against or remove, as by the time the anti-malware app has loaded (after windows boot), it’s already there.<br />
Unfortunately, with Secure Boot enabled, you’ll also be prevented from launching any boot code for which for the machine doesn’t have the appropriate certificate keys. Now, it is entirely possible for other organisations to provide secure keys to manufacturers – like a set of keys for Ubuntu for example – but manufacturers are under absolutely no obligation to incorporate these; and without them, the other OS just won’t install or boot.<br />
So is it time to say goodbye to installing another OS?<br />
<h2 style="font-size: 1.5em;">
Microsoft’s Response</h2>
In response to the concerns that this might prevent other operating systems from being installed,Microsoft has stated that secure boot is optional, and can be turned off from within the pre-boot setup screen. Here’s a screenshot from the MSDN Windows 8 blog post on the topic, clearly showing it’s optional on the Windows-8 based Samsung tablet that was offered to //BUILD/ participants whereWindows 8 was first demoed.<br />
<img alt="windows 8 blocks linux" data-mce-src="http://www.new-technology-news.net/wp-content/uploads/2011/10/f0d5ff5dcdboot.jpeg.jpeg" height="329" src="http://www.new-technology-news.net/wp-content/uploads/2011/10/f0d5ff5dcdboot.jpeg.jpeg" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px;" width="480" /><br />
<h2 style="font-size: 1.5em;">
So, End Of Story?</h2>
Not entirely it would seem. As Matthew Garret notes:<br />
<blockquote>
<em>Windows 8 certification does not require that the user be able to disable UEFI secure boot, and we’ve already been informed by hardware vendors that some hardware will not have this option.</em></blockquote>
That’s right – although some manufacturers may choose to make the Secure Boot setting optional and therefore able to be disabled by the user – gaining certifications for Windows 8 compatibility does not require it, and some have explicitly stated it will not be optional on their machines (though there are no details on precisely which manufacturers have stated this yet).<br />
Microsoft has thrown the ball to the manufacturers court, and it could go either way. The PC business is incredibly competitive, so getting that Windows logo is all important, that’s a given. On the one hand, manufacturers will be keen to offer the best computing experience to the majority of their customers and if that means mitigating yet another security threat (and the inevitable support calls they need to deal with boot-level malware), then they’ll go for it. Other operating systems can still be run, if they provide certificate keys and if the manufacturers agree to include them. On the other hand, I suspect a real PR backlash will be forthcoming against any PC makers that do decide to force Secure Boot onto the user, so it may be a non-issue in the end.<br />
<h2 style="font-size: 1.5em;">
What Can You Do About It?</h2>
The Free Software Foundation is running a petition encouraging computer makers to support Secure Boot in a way which ensures the user has control – specifically, the option to turn it off entirely. Be sure to head over and sign now if you’re at all interested in consumer freedoms and the right to run alternative operating systems on your own PC.<br />
<img alt="windows 8 limitations" data-mce-src="http://www.new-technology-news.net/wp-content/uploads/2011/10/ce421ea0c9fsf.png.png" height="323" src="http://www.new-technology-news.net/wp-content/uploads/2011/10/ce421ea0c9fsf.png.png" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px;" width="580" /><br />
Also, be sure to share this post with all your friends to explain the issue and why they should care, getting them to sign the petition too.<br />
<small>Source: Free Software Foundation</small><br />
</div>

Windows 8 Branded PCs Could Prevent Other Operating Systems From Being Installed

“Secure Boot” is a new Windows 8 technology that’s required of OEM computers if they are to feature the Windows 8 Compatibility Logo. It’s...

Facebook Says 600,000 Accounts Compromised Per Day

Facebook Says 600,000 Accounts Compromised Per Day

In a blog entry on Thursday, Facebook stated that about 600,000 log-ins every day are compromised. The factoid, first noted by secu...

How Encryption Works? That Keeps Your Data Safe

<div dir="ltr" style="text-align: left;" trbidi="on">
<span class="Apple-style-span" style="font-size: 14px; line-height: 19px;"><span class="Apple-style-span" style="font-family: 'Helvetica Neue', Arial, Helvetica, sans-serif;"></span></span><br>
<span class="Apple-style-span" style="font-family: 'Helvetica Neue', Arial, Helvetica, sans-serif;"><img alt="Encryption" class="aligncenter" data-mce-src="http://www.coated.com/wp-content/uploads/2009/12/gsm-encryption-cracked.jpg" height="263" src="http://www.coated.com/wp-content/uploads/2009/12/gsm-encryption-cracked.jpg" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px; display: block; margin-left: auto; margin-right: auto;" title="Encryption" width="451"></span><br>
<span class="Apple-style-span" style="font-family: 'Helvetica Neue', Arial, Helvetica, sans-serif;"><br></span><br>
<span class="Apple-style-span" style="font-family: 'Helvetica Neue', Arial, Helvetica, sans-serif;">When you choose to back up your data online, you agree to store some of your most sensitive data insidedata centers, from your tax returns to your family photos.  Thankfully, your data is encrypted with a special key so that only you can access it. But how does encryption work, and how can you be sure that your data is safe?</span><br>
<br>
</div>

How Encryption Works? That Keeps Your Data Safe

When you choose to back up your data online, you agree to store some of your most sensitive data insidedata centers, from your tax retur...

“Massive” security/privacy issues found in HTC phones

“Massive” security/privacy issues found in HTC phones

The Android world had a major shock earlier today when several members of Android Police (appropriate, no?) published a “massive” securi...

In Depth: What's your life worth to an ID thief?

<div dir="ltr" style="text-align: left;" trbidi="on">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Georgia, 'Bitstream Charter', serif; line-height: 24px;"></span><br />
<div style="background-attachment: initial; background-clip: initial; background-color: white; background-image: initial; background-origin: initial; background-position: initial initial; background-repeat: initial initial; color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 12px; font: normal normal normal 13px/19px Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; line-height: 18px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; max-width: 640px; padding-bottom: 0.6em; padding-left: 0.6em; padding-right: 0.6em; padding-top: 0.6em;">
<div mce_style="text-align: center;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px; text-align: center;">
<img alt="In Depth: What's your life worth to an ID thief?" class="aligncenter" height="212" mce_src="http://cdn.mos.techradar.com//Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage6-470-75.jpg" src="http://cdn.mos.techradar.com//Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage6-470-75.jpg" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px; clear: both; color: #444444; display: block; font-family: Georgia, 'Bitstream Charter', serif; line-height: 1.5; margin-bottom: 12px; margin-left: auto; margin-right: auto; margin-top: 0px; max-width: 640px;" width="282" /></div>
<h3 style="color: black; font-family: Georgia, 'Bitstream Charter', serif; font-size: 1.4em; line-height: 1.5em; margin-bottom: 20px; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
What's your life work to an ID thief?</h3>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
During 2002, JP Martin decided to analyse every bit of information his company had about its customers. The firm, Canadian Tire, had its own credit card and Martin discovered patterns in his customers' purchases.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Customers who bought carbon monoxide detectors for their houses or felt pads to stop chairs scratching the floor rarely missed a payment, but those who bought chrome skull decorations for their cars were almost certain to fall behind.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Martin's discoveries became the data mining industry, and today almost every bit of data about you is worth money to somebody. How much is personal information worth?</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
If you ask Tesco, the answer might be £3.8 billion: that's its annual profit before tax, and if it weren't for its Clubcard loyalty programme that figure might be much lower.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Clubcard isn't just about bombarding you with coupons for days out at Legoland: the firm also uses it to decide what it should stock, when it should stock it and where it should put it. As the BBC reports, Clubcard data can even help the firm "work out whether, for instance, the inhabitants of a town objecting to a new store were shopping at another Tesco some miles away."</div>
<div mce_style="text-align: center;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px; text-align: center;">
<img alt="Clubcard" class="aligncenter" height="159" mce_src="http://mos.futurenet.com/techradar/Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage1-420-90.jpg" src="http://mos.futurenet.com/techradar/Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage1-420-90.jpg" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px; clear: both; color: #444444; display: block; font-family: Georgia, 'Bitstream Charter', serif; line-height: 1.5; margin-bottom: 12px; margin-left: auto; margin-right: auto; margin-top: 0px; max-width: 640px;" width="252" /></div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Tesco isn't the only firm using your data to keep tabs on you. TFL stores details of Oyster card users' trips, credit reference agencies track our transactions, and most of the firms we do business with will cheerfully flog our details if we forgot to tick a tiny little box in an obscure corner of a form.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
So where does our data end up, and how much is it worth? Tesco's enormous customer database is a trade secret, closely guarded, but many firms sell on customer data to firms like Data HQ, which promises "precision targeting" of businesses and consumers.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
It isn't kidding: available mailing lists include lists of people interested in specific kinds of charities, people who holiday by going camping, people who buy plants and bulbs through mail order, people who have back pain, people who have had an industrial accident within the last two years and so on.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The back pain list has 391,900 entries, and offers "more than 300 selection criteria from age and income to interests and travel through to the preferred newspaper to the value of their quarterly electricity bill."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Expect to pay £130 per 1,000 addresses for a standard mailshot, and another £100 per 1,000 if you'd like a list of phone numbers too.</div>
<h4 style="color: black; font-family: Georgia, 'Bitstream Charter', serif; font-size: 1.2em; line-height: 1.5em; margin-bottom: 20px; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
Eight out of 10 cat owners</h4>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The range of available lists is eye-opening. Firms like Consumersketch can tailor lists of contact details to almost any requirement. Prices are per 1,000 records, and start at £110 for basic list rental. Mobile phone numbers are an additional £70, details of ISPs are £40, and extra selections - geographical area, marital status, income bracket, house, favourite newspaper, hobbies, charities, magazine readership and leisure activities - are £50 a pop.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
That data is clean, checked and legal, and it's from people who've opted in by completing questionnaires. The value of such data to marketers is clear: being able to target people who belong to particular demographics or who have particular interests means you're less likely to waste your marketing efforts.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
For example, if you're selling medical lotions and potions, it makes sense to target people who are suffering from the conditions your products are designed to treat.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Unfortunately, some marketers can be a little bit too greedy in their pursuit of data. In 2009, ITV's <span class="Apple-style-span" mce_name="em" mce_style="font-style: italic;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-style: italic; line-height: 1.5;">Tonight</span> programme found that electronic medical records from some private hospitals were being sold on the underground market for £4 apiece. Of the 116 files purchased by the programme makers, 100 were real - and the records were being sold to unscrupulous medical and pharmaceutical companies keen to target the vulnerable.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
As ITV discovered, not all data is circulating with its owners' permission.</div>
<h4 style="color: black; font-family: Georgia, 'Bitstream Charter', serif; font-size: 1.2em; line-height: 1.5em; margin-bottom: 20px; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
Everything counts</h4>
<div mce_style="text-align: center;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px; text-align: center;">
<img alt="Zukerberg" class="aligncenter" height="168" mce_src="http://mos.futurenet.com/techradar/Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage3-420-90.jpg" src="http://mos.futurenet.com/techradar/Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage3-420-90.jpg" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px; clear: both; color: #444444; display: block; font-family: Georgia, 'Bitstream Charter', serif; line-height: 1.5; margin-bottom: 12px; margin-left: auto; margin-right: auto; margin-top: 0px; max-width: 640px;" width="252" /></div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
If something is protected with a password or PIN, it's going to be worth something to somebody - so how much would the keys to your Facebook account be worth, for example?</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The social networking firm would be nothing without its users, so it's reasonable to take its current market valuation - an estimated $55 billion - and divide it by the number of active users, which Facebook says is over 500 million. That would value an individual Facebook account at around $100.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Your Facebook account might be worth $100 in the eyes of potential investors in the company, but it's worth considerably less on the black market. Eddy Willems is a Security Evangelist with G Data Software AG.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"Normal Facebook prices range from $5 to around 10 cents," he says. "If the account includes an email account then it goes up to around $15, but the real money is if you can grab an account from someone famous."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The more connections you have, the more useful your account becomes. "If you can access lots of Facebook friends, you can try to get into those relationships," Willems explains. You can use these relationships to spread malware, or attempt to defraud the real account owner's friends.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
McAfee has been tracking the price of social network accounts, and found that a Facebook account with 1,000 friends was worth between $5 and $25, while a <span class="Apple-style-span" mce_name="em" mce_style="font-style: italic;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-style: italic; line-height: 1.5;">World of Warcraft</span> account with a high score could net between $120 and $200. <span class="Apple-style-span" mce_name="em" mce_style="font-style: italic;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-style: italic; line-height: 1.5;">Runescape</span> accounts are worth more still: from $40 to a staggering $1,200.</div>
<h3 style="color: black; font-family: Georgia, 'Bitstream Charter', serif; font-size: 1.4em; line-height: 1.5em; margin-bottom: 20px; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
Supply and demand for stolen data</h3>
<div mce_style="text-align: center;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px; text-align: center;">
<img alt="Runescape" class="aligncenter" height="161" mce_src="http://mos.futurenet.com/techradar/Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage4-420-90.jpg" src="http://mos.futurenet.com/techradar/Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage4-420-90.jpg" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px; clear: both; color: #444444; display: block; font-family: Georgia, 'Bitstream Charter', serif; line-height: 1.5; margin-bottom: 12px; margin-left: auto; margin-right: auto; margin-top: 0px; max-width: 640px;" width="252" /></div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Prices are hugely variable, as David Emm, senior technology consultant with Kaspersky Lab UK explains. "Prices for stolen confidential data in the 'dark market' vary depending on the conditions at play in the market," he says.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"In this respect, cybercrime markets are like any other - prices vary depending on supply and demand, the activities of law enforcement agencies and anti-malware vendors, and so on. For example, the prices for stolen online games characters and virtual assets have been falling as the market becomes more saturated."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The more you do, the more your identity is worth. "Overall, my 'value' in the dark market will also depend on the size of my overall online footprint," Emm says. "Do I just bank online? Or do I also shop online frequently? Or do I also socialise using Facebook, Twitter and so on? Even if I do none of these things, I still have value for cybercriminals - they can use my computer to deliver spam, or as part of a distributed denial of service attack on an online organisation."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The rate for that? Just $15 for 10,000 infected PCs. If price is a reflection of supply and demand, the news that the price of off-the-shelf attack kits is falling is deeply worrying.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
McAfee's latest Underground Economy report found that some exploit packs - collections of tools that can be used to inject code into websites to intercept data or reroute browsers - were changing hands online for as little as $25. Most tools are more expensive than that, but not by much: most off-the-shelf tools go for a few hundred dollars.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Those tools aren't just affordable - they're very effective. Kevin Bocek is product director with IronKey. "The proliferation of tools available to criminals like Zeus, SpyEye, OddJob, Sunspot and many more to directly harvest details is enabling criminals to immediately monetise their stolen information," he says.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"They may then look to resell this information to other criminals, but the tools have made sophisticated and successful attacks much easier for individual gangs to perpetrate their crimes."</div>
<h4 style="color: black; font-family: Georgia, 'Bitstream Charter', serif; font-size: 1.2em; line-height: 1.5em; margin-bottom: 20px; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
Bulk buys</h4>
<div mce_style="text-align: center;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px; text-align: center;">
<img alt="Data for sale" class="aligncenter" height="215" mce_src="http://mos.futurenet.com/techradar/Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage5-420-90.jpg" src="http://mos.futurenet.com/techradar/Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage5-420-90.jpg" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px; clear: both; color: #444444; display: block; font-family: Georgia, 'Bitstream Charter', serif; line-height: 1.5; margin-bottom: 12px; margin-left: auto; margin-right: auto; margin-top: 0px; max-width: 640px;" width="252" /></div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Most of our information is traded in bulk, with discounts for big purchases and regular customers. McAfee found that 500 Twitter accounts will net $65, while $100 gets you 1,000 MySpace logins and $160 pays for 10,000 AOL logins.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The biggest market is for email addresses, where accounts are traded for tiny sums. One hundred unverified Gmail logins are worth $20, rising to $120 for 1,000 accounts, while verified accounts are worth slightly more: $30 for 100 or $190 for 1,000.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Hotmail accounts are worth considerably less - $150 will net you 10,000 verified Hotmail addresses - and you can pick up 100 Yahoo email addresses for as little as $3. If you're not fussed about which email provider your addresses come from, Eddy Willems suggests that "one million verified email addresses range from around €30 to €250."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
McAfee agrees, reporting figures of around $100 for one million addresses, and $1,500 for 32 million addresses. You can pick up email addresses for next to nothing because the amount of information they offer for exploitation is fairly basic.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
When it comes to sharing our online information, the real money's in money.</div>
<h4 style="color: black; font-family: Georgia, 'Bitstream Charter', serif; font-size: 1.2em; line-height: 1.5em; margin-bottom: 20px; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
Cloning cards</h4>
<div mce_style="text-align: center;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px; text-align: center;">
<img alt="Cloning cards" class="aligncenter" height="189" mce_src="http://mos.futurenet.com/techradar/Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage6-420-90.jpg" src="http://mos.futurenet.com/techradar/Review%20images/PC%20Plus/PCP%20311/PCP311.feat3.bodyimage6-420-90.jpg" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px; clear: both; color: #444444; display: block; font-family: Georgia, 'Bitstream Charter', serif; line-height: 1.5; margin-bottom: 12px; margin-left: auto; margin-right: auto; margin-top: 0px; max-width: 640px;" width="252" /></div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Your credit card is worth less than you might think. As David Emm explains, "Credit cards could fetch as little as $2 or as much as $50, depending on accompanying data like the CVV number, the available balance on the card and so on."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Prices vary from territory to territory too, so a UK card will command a higher price than a US one, and a central European card will command more still. "The higher the protection, the higher the possibility that you can use the details to gain money and the more it costs," Willems says.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Another reason for the disparity in prices is wealth. "The UK has a lot of wealthy people, and if you compare that with the US there's a real difference."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Credit card details are known online as 'dumps', which means the information copied from the magnetic strip on the back of your card. A UK dump including your card number, your full name, address, postcode, expiry date and CVV code costs around $4.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
McAfee found that US cards with the same accompanying data are sold for $2, Canadian ones $4, Australian ones $7 and European and Asian cards $8. The more information is supplied, the more it costs.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The same card details with associated PayPal logins, bank details, dates of birth and so on command $25 for UK cards, $30 for German and Italian ones and $15 for American ones. A PIN code can treble the value of a card, while the combination of a PIN and a good available balance increases the price of a European Gold credit card from around $45 to $250.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
A standard credit card with 'fullz' and 'COB' - that is, a card with all the associated information you need to use that card online and a login you can use to change the shipping/billing address - is around $200 for a US card.</div>
<h4 style="color: black; font-family: Georgia, 'Bitstream Charter', serif; font-size: 1.2em; line-height: 1.5em; margin-bottom: 20px; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
Stolen to order</h4>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
You can even buy custom data, like logins for a specific bank. That will cost you a $1,000 up-front payment and another $4,000 when the project is ready to go, and the price is already falling.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"Recent advertisements on underground forums are offering $2,000 per bank attack," Kevin Bocek says. "Hundreds or thousands of bank customers can be attacked easily, so the value of individual records is being driven down."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Gerhard Eschelbeck is Chief Technical Officer with Webroot. "Similar to a market economy, prices of online identities are a reflection of supply and demand, and vary from pennies to hundreds of pounds per unit," he explains. "Quality factors like verified-as-still-valid accounts, as well as accessible content (monetary or information) also drive pricing of online identities. The popularity of the application or account is also driving the cost of such stolen identities."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Where things get dangerous is when one account can be used as a key to unlock several others. "Sometimes a low priced identity can also yield access to multiple high priced accounts," Eschelbeck says, "especially if users are using the same password for different services."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
It's a similar story with physical documents, as David Emm explains. "Higher prices are fetched for bundles of stolen IDs," he says, describing one market for stolen ID where "a UK passport was offered for €750. With a driving licence the price was €850, and with a licence and a photo ID card it was €950."</div>
<h4 style="color: black; font-family: Georgia, 'Bitstream Charter', serif; font-size: 1.2em; line-height: 1.5em; margin-bottom: 20px; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
Who's sharing your stuff?</h4>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"Cybercrime is now a part of global organised crime," Kevin Bocek explains. "Cyber gangs are multi-tier, multi-national organisations."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Eddy Willems agrees. "You'll always have kids trying to steal or create malware, but most ID sharing is big business. You'll have programmers, people actually selling the information - two or three guys selling whatever their malware has intercepted, and even creating websites to sell it. It's a pretty well-organised business, because you can only make money if you're organised."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Thanks to the internet, criminals have a global reach - but they tend to be concentrated in specific areas. "It's more or less the same marketplace where you'll find back-door trojans and things like that," Willems says. "South America is big, and a lot of business is done in Asia now. Selling is mainly done on sites you can find in the USA."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
You'll also find significant levels of activity emanating from Russia and Eastern Europe. The latest Symantec Internet Security Threat Report found that the average number of identities exposed in a corporate data breach is a massive 260,000, but even that's tiny compared to the millions of accounts exposed when Sony's PlayStation Network (PSN) was compromised earlier this year.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
As Eddy Willems points out, "if you look at the big Sony hack, not only do you have the email addresses, you also have the passwords. If you have enough people, they can try these logins on other sites - Facebook and so on."</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Such tactics will continue to be effective as long as most people don't take the security of their online accounts seriously.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"Most people just use one or two passwords," Willems says "That's the problem - if you look at it carefully, you could try a specific attack on a specific company. We have been very lucky. So far, the people behind the attacks are not too clever, and they haven't gained access to more data. It could be much more dramatic."</div>
</div>
</div>

In Depth: What's your life worth to an ID thief?

What's your life work to an ID thief? During 2002, JP Martin decided to analyse every bit of information his company had about i...

#Antisec hackers release 10GB of law enforcement data

#Antisec hackers release 10GB of law enforcement data

After releasing the details of over 7,000 law enforcement officers last week, it looks like Anonymous is back again, this time with the ...

Second accused AT&T iPad hacker in plea talks

<div dir="ltr" style="text-align: left;" trbidi="on">
<span class="Apple-style-span" style="border-collapse: separate; color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 24px; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;"><div style="background-color: white; color: #444444; font-family: Georgia,'Times New Roman','Bitstream Charter',Times,serif; font-size-adjust: none; font-size: 13px; font-stretch: normal; font-style: normal; font-variant: normal; font-weight: normal; line-height: 19px; margin: 0px; max-width: 640px; padding: 0.6em;">
<div mce_style="text-align: center;" style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px; text-align: center;">
<img alt="" border="0" class="aligncenter" height="100" mce_src="http://img225.imageshack.us/img225/530/ipad28.jpg" src="http://img225.imageshack.us/img225/530/ipad28.jpg" style="border-width: 0px; clear: both; color: #444444; display: block; font-family: Georgia,'Bitstream Charter',serif; line-height: 1.5; margin: 0px auto 12px; max-width: 640px;" width="279" /></div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Last month, Daniel Spitler pleaded guilty to hacking account information from AT&T 3G iPads and faces up to 10 years in prison. His alleged partner in crime, Andrew Auernheimer, is now reportedly negotiating a plea deal as well. Auernheimer's case is currently on hold during these negotiations.</div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Spitler and Auernheimer are responsible for writing an iPad 3G Account Slurper tool that parsed the SIM card numbers of AT&T iPad 3G owners and used them to retrieve email addresses from the carrier's website. They pair and their associated hacking group reportedly grabbed over 100,000 email records and brazenly flaunted their theft before being caught. The theft was particularly stinging as many of those records belonged to government officials and military personal.</div>
</div>
</span></div>

Second accused AT&T iPad hacker in plea talks

Last month, Daniel Spitler pleaded guilty to hacking account information from AT&T 3G iPads and faces up to 10 years in prison. His...

Netswipe turns your webcam into a credit card reader, brings POS payments to the desktop

<div dir="ltr" style="text-align: left;" trbidi="on">
<span class="Apple-style-span" style="border-collapse: separate; color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 24px; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;"><div style="background-color: white; color: #444444; font-family: Georgia,'Times New Roman','Bitstream Charter',Times,serif; font-size-adjust: none; font-size: 13px; font-stretch: normal; font-style: normal; font-variant: normal; font-weight: normal; line-height: 19px; margin: 0px; max-width: 640px; padding: 0.6em;">
<div mce_style="text-align: center;" style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px; text-align: center;">
<img alt="" border="1" class="aligncenter" height="240" hspace="4" mce_src="http://img854.imageshack.us/img854/2584/20110726netswipe.jpg" mce_style="margin-top: 4px; margin-bottom: 4px; border: 1px solid black;" src="http://img854.imageshack.us/img854/2584/20110726netswipe.jpg" style="border: 1px solid black; clear: both; color: #444444; display: block; font-family: Georgia,'Bitstream Charter',serif; line-height: 1.5; margin: 4px auto; max-width: 640px;" vspace="4" width="360" /><br style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; line-height: 1.5;" />Credit card fraud costs the banking industry billions of dollars every year, and with companies yet to find an entirely secure system for processing payments online, there's no end in sight for unauthorized transactions. Jumio hopes to bring both security and convenience to the world of online payments, however, with its webcam-based Netswipe secure card reader solution. The system replicates the point of sale (POS) transactions you experience when making in-store purchases, prompting cardholders to scan the front on their credit card, then enter their CVV code using a tamperproof mouse-controlled interface. We're not sure how the software is able to distinguish a physical credit card from, say, a photocopy of a card, but it certainly sounds more secure than the standard input form we use today. It also reduces card number theft from insecure forms and website spoofing, by verifying details through a live video stream. Jump past the break for the full press release, along with video overviews of Netswipe and Jumio, which recently secured $6.5 million in initial funding and is backed by Facebook co-founder Eduardo Saverin.</div>
</div>
</span></div>

Netswipe turns your webcam into a credit card reader, brings POS payments to the desktop

Credit card fraud costs the banking industry billions of dollars every year, and with companies yet to find an entirely secure system for...

Anonymous Teases NATO Hack, Challenges FBI

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div style="background-attachment: initial; background-clip: initial; background-color: white; background-image: initial; background-origin: initial; color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 12px; font: normal normal normal 13px/19px Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; line-height: 18px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; max-width: 640px; padding-bottom: 0.6em; padding-left: 0.6em; padding-right: 0.6em; padding-top: 0.6em;">
<div mce_style="text-align: center;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px; text-align: center;">
<img alt="Anonymous Teases NATO Hack, Challenges FBI" class="aligncenter" height="335" mce_src="http://img841.imageshack.us/img841/9985/550xanonymousmembers.jpg" src="http://img841.imageshack.us/img841/9985/550xanonymousmembers.jpg" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px; clear: both; color: #444444; display: block; font-family: Georgia, 'Bitstream Charter', serif; line-height: 1.5; margin-bottom: 12px; margin-left: auto; margin-right: auto; margin-top: 0px; max-width: 640px;" title="Anonymous Teases NATO Hack, Challenges FBI" width="550" /></div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Thursday NATO said it was investigating claims that “hactivist” group Anonymous had breached its security and obtained “scads” of confidential material.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The group made its latest feat known via Twitter early Thursday morning, claiming to be sitting on 1 GB of sensitive data. It even offered a sample, a NATO Restricted PDF, but the file has sense been removed. Given the sensitivity of its new-found booty, the group actually refuses to publish <span class="Apple-style-span" mce_fixed="1" mce_name="em" mce_style="font-style: italic;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-style: italic; line-height: 1.5;">all</span> the data, saying that to do so would be “irresponsible.”</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
“Hi NATO. Yes we haz [sic] more of your delicious data,” the group tweeted. “You wonder where from? No hints, your turn. You call it war; we laugh at your battleships.”</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
“NATO is aware that hacker group released what it claims to be NATO classified documents on the internet,” a NATO spokseman said in a statement. “NATO security experts are investigating these claims. We strongly condemn any leak of classified documents which could potentially endanger the security of NATO allies, armed forces and citizens.”</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The NATO hack arrives just after the FBI conducted a sweep across the nation on Tuesday, arresting 16 alleged Anonymous members. 14 individuals were arrested in Alabama, Arizona, California, Colorado, the District of Columbia, Florida, Massachusetts, Nevada, New Mexico, and Ohio. Two other individuals were arrested on similar charges in two separate complaints filed in the Middle District of Florida and the District of New Jersey.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
“We want to send a message that chaos on the Internet is unacceptable,” Steven Chabinsky, deputy assistant FBI director, said in an interview with NPR on Wednesday. “[Even if] hackers can be believed to have social causes, it’s entirely unacceptable to break into websites and commit unlawful acts.”</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Both Anonymous and LulzSec followed up with a joint statement to the FBI and Chabinsky on Thursday, listing what the groups deem as unacceptable including government deception, corporations aiding the government and lobby conglomerates pushing for higher profits.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
“These governments and corporations are our enemy. And we will continue to fight them, with all methods we have at our disposal, and that certainly includes breaking into their websites and exposing their lies,” the statement reads. “We are not scared any more. Your threats to arrest us are meaningless to us as you cannot arrest an idea. Any attempt to do so will make your citizens more angry until they will roar in one gigantic choir. It is our mission to help these people and there is nothing – absolutely nothing – you can possibly to do make us stop.”</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
“We become bandits on the Internet because you have forced our hand,” the statement concludes. “The Anonymous bitchslap rings through your ears like hacktivism movements of the 90s. We’re back – and we’re not going anywhere. Expect us.”</div>
</div>
</div>

Anonymous Teases NATO Hack, Challenges FBI

Thursday NATO said it was investigating claims that “hactivist” group Anonymous had breached its security and obtained “scads” of conf...

Managing Risk in IT Security For Mid-Sized Companies

<P> </P><br /><P>Get all your IT security questions answered by James Randell in a comprehensive interview.</P><br /><P> </P><br /><P>I have implemented firewalls and anti-virus, are these the main security tools I need? <BR>Certainly firewall and anti virus tools are very important for business organisations, but we need to be clear about what they really do. Firewalls are primarily a network access control technology. This is an important function in today's networks, its particularly important that you should set restrictions on who should access your network but its just as important that you look at the content of the 'envelope'.</P><br /><P> </P><br /><P>Antivirus tools are also very important for organisations, they assist them in defending there servers and desktops against attack by malicious software like viruses, Trojans and worms, etc. As long as you're clear about what the tools do, they are important, but not every organisations security challenges are going to be solved by managing network access control and defending against malicious software, so an organisation really needs to take a risk based approach at looking at what security tools they need.</P><br /><P> </P><br /><P>What exactly is security anyway? <BR>This is actually quite straightforward but still it confuses a lot of people. Security is about managing risk to your business. Risk might affect your ongoing profitability, your revenues or it might effect your organizational climate. The idea is to manage, control and assess those risks.</P><br /><P> </P><br /><P>What are some of the main security issues faced by companies today? <BR>This can vary quite a bit depending on the organisation and what kind of online presence they maintain, but some of the main issues are things like remote network base attacks. There are also legal compliance issues - complying with industry specific regulatory frameworks are also a concern for organisations. The miss appropriation of confidential data or propriety information such as trade secrets and designs are also a major consideration for organisations.</P><br /><P> </P><br /><P>It is very difficult to get straight answers about exactly what I need to do to comply with an industry-specific regulation? <BR>Part of the problem here is that compliance framework and compliance requirements can often be given scary names. The thing to remember about these, is that when you look at all the different regulatory and compliance frameworks, most of them share so much common ground. Providing you are approaching your security policies and processes and tool deployments from a best practice and common sense point of view, you're actually likely to be complying with the greater part of nearly all compliance frame works. There are some specific industry variations though which you do need to be aware of, but they are mostly all about best practice and nothing to be too scared of.</P><br /><P> </P><br /><P>Why do vendors keep trying to scare me into buying security products? <BR>Its good that the tools are working and that nothing bad has happened but it is still very important to keep security tools up to date. Attackers are continually researching new methods and new ways to attack and compromise systems. However, you should never buy or invest in security products because of, or through vendor's attempts to scare you into buying them.</P><br /><P> </P><br /><P>How do I decide what tools I need to implement, when they seem very similar? <BR>This can be a particular problem for buyers of security - the tools all sound roughly the same, having very similar claims, very similarly worded and they all sound like they do the same thing. Yet they can cost completely different amounts. The real thing driving that is the amount of security research that the vendors are investing in their product development, this is one of the key differentiators in the security industry. The vendors who are investing very heavily in original propriety systems and security search work are able to keep their products that much better positioned to protect customers systems and infrastructures against the kind of attack they're going to see tomorrow and provide that kind of protection today. This is one of the main factors in the costs.</P><br /><P> </P><br /><P>Where do most of the threats to an organisation really come from, outside hackers or malicious insiders? <BR>We see the headlines being made in the media focusing on hacking attacks from external sources, breaking into systems, stealing confidential data, defacing systems and therefore affecting brand equity etc. however the majority of the money is being lost is through internal attacks, for example where an employee maybe has legitimate access to a database at a high level but then becomes disgruntled they may misuse that privilege or be tricked into misusing that privilege in order to access a huge amount of data which they may then sell on which is why it's the internal malicious insiders that cause the most amount of damage.</P><br /><P> </P><br /><P>How do you train and retain skilled security experts and is this expensive? <BR>This can be a real problem for organisations, when you invest in security tools such as firewalls and anti virus systems, you will have access to copious amounts of alert data from them. The challenge is then getting actionable security intelligence out of these tools, this can be outsourced to help you analyze the data and decide if you really are under attack. There are specialist organisations who would own that problem for you, they can hover up all your alert data analyze and process it all and then they can call you if there's something your should be worried about. This is a very easy way to deal with this problem.</P><br /><P> </P><br /><P>How do you understand all the various elements involved with IT security? <BR>If you're looking from the ground up, the security industry can seem very complicated. There are firewalls and remote access systems and virtual private networks systems and cryptography tools etc. The answer to this is to look at it from the top down, you need to approach this from the point of view of managing the risk to your business. If you understand what risks your organisation is actually susceptible to and what the consequences are then you can find relatively readily what tools you're going to need.</P><br /><P> </P><br /><P>What is a "security policy" and what do I need one for? <BR>A security policy is a frame work and a set of rules and guidelines for an organisation which help it meet any objectives. If you don't know where you're going, how are you going to get there? Is particularly applicable here. This is why a security policy is very important because it helps you understand where you're trying to get to by establishing, what your security objectives are for your organisation.</P><br /><P> </P><br /><P>Why do security technologies seem to focus on "cleanup" when surely "prevention" is better? <BR>Prevention is always going to be better than cure. Clean up is very inconvenient, if you just think about your own desktop or laptop, if it gets infected with a virus, it has to be sent back to the IT department and you'll have to do without it all day whilst everything is reinstalled and even then all your data might still be lost. Due to the fact that attackers and attack trends are evolving all the time, its essential that security tools vendors and security development vendors are investing heavily in original security research so that they can ensure that their products are protecting against the kind of threats that organisations will be exposed to tomorrow and prevent the bad things from happening today.</P><br /><P> </P><br /><P>How do I stop security just "getting in the way" of my day-to-day operations? <BR>Security tools and processes can seem like they are getting in the way of day-to-day operations. This can be particularly frustrating, maybe those tools have not been properly deployed or wisely chosen or well configured. As long as we are still approaching this from a well grounded risk based point of view for our business then its relatively easy to select proper tools and understand how to deploy them.</P><br /><P> </P><br /><P>I hear a lot about risk assessment being key to budgeting for security spending. How do I even begin to quantify risk? <BR>As a society we can be quite bad at assessing risk, sometimes we'll fret about highly improbable risks and then ignore the obvious. For any given risk there are several things you can do, firstly you can mitigate the risk, so you can try to defend against it or control it. You could choose to transfer the risk and pass it to someone else like insurance for example. Or you could chose acceptance, you accept the risk is so unlikely or the cost of the devastation would be too insurmountable and disproportionate to mitigating against it in the first place. These are all perfectly acceptable attitudes towards managing and identifying a risk. In a risk assessment, once you have identified the risks to your business, you can calculate something called an annual loss risk acceptancy which is basically you putting a value on what the impact to your business would be if that risk were to happen, you then make an estimate of how many times of year that's likely to happen. Once you've multiplied these two things together you can work out how much you're likely to loose should this happen as a result of that risk from this you can then work out how much would be practical on dealing with that risk.</P><br /><P> </P><br /><P>As a small to medium business, what are three simple things I could do to quickly improve my security posture? <BR>The first really simple thing you could do, would be patching, it is essential to keep your systems up to data with the latest software patches released by the vendors, this is often ignored because it requires down times to apply the patches but it's too dangerous to ignore.The second thing you could do, would be to get really good user control over the accounts and logins and the user passwords systems, make sure no one is using really obvious passwords like name or registration plate. It also very important to remove accounts which are no longer needed, if someone leaves, or changes departments. You also need to set proper access levels, it's a lot easier to just give everyone administration access but its not safe because you're giving them access to far more stuff than they actually need. The third thing you can do may be a little harder; you need to understand whether the alerts you're getting from your tools are valid. This can be outsourced so you don't have to work your way through lots of data. Then the outsourced company would alert you if there were something you need to be aware of.</P><br /><P> </P><br /><P>What is the importance of patching? <BR>The issue here is about the skill that the attackers can apply to finding weaknesses in systems and using those in a remote and silent way to get control of your systems. Very skilled attackers can make use of these defects in really devastating ways, they can get control of your systems remotely and access and steal data, they could put some malware on your system which would bring the system down and in the worst cases they could take over administrative control of the system completely which can be devastating, this is why its really very important to use patches and keep systems up to date.</P><br /><P> </P><br /><P>How can I be sure that security vendors are keeping a step ahead of the bad guys? <BR>It is here that we can see research work done between the security vendors and technology developers and looking at what tomorrow's attacks are likely to be like and attackers who are constantly advancing the state of their art. For the time being it doesn't look like that race will be over.</P><br /><P> </P><br /><P>Every new technology I implement seems to introduce new security weaknesses, how can I resolve this? <BR>It would be a shame for technology deployment and progress to stagnate in the face or fears over security, the answer is to be approaching new technology development from a risk management perspective so a thorough analyses of the kind of risks you may be exposed to as a result of deploying a new technology is absolutely necessary before you embark on the deployment and as long as you do that you can embark on new technologies quite safely and select the necessary security stools processes staff training and other things to help you manage the deployment to make sure it doesn't affect your organisations overall technology stance.</P><br /><P> </P><br /><P>What is "penetration testing" or "ethical hacking" and how can it help me? <BR>Penetration testing is really about you understanding what your systems look like from the point of view of an external highly skilled attacker who's trying to break into your systems, there are people who do this as a profession who can assess your systems by using the same techniques a skilled attacker would use, they might try to attack your systems over the network or the might try to trick your people into revealing passwords etc by phoning them and pretending to be from the helpdesk. Penetration testing and ethical hacking is the name used for this and its letting you see how your systems would cope if they were to come under attack.</P>

Managing Risk in IT Security For Mid-Sized Companies

Get all your IT security questions answered by James Randell in a comprehensive interview. I have implemented firewalls and anti-virus, ...

The Need for Physical and IT Security Convergence

<P> </P><br /><P>Business security professionals make it a point to study their craft and learn ways to counter evolving threat. Business intelligence methods need to continue to keep up with technology to analyze and prevent the internal and external influences that can ruin the enterprise. The threats corporations face include: theft, vandalism, workplace violence, fraud, and computer attacks. Through a system of identification, analysis, risk assessment operation security and prevention, astute managers can mitigate risks.</P><br /><P> </P><br /><P>Theft affects all. On average the median loss of theft of cash and non-cash assets is $223,000 (ACFE). The costs of theft are passed on to consumers to bear the cost of the loss. A simple way for companies in retail to get back from a bottom line loss is to pass the costs on by increasing the top line. Raising prices is a symptom of theft, but not a cure. It does nothing by itself to stop the activity other than punish the innocent.</P><br /><P> </P><br /><P>Many companies have invested in security staff. This staff focuses efforts to identify and prevent theft. Many businesses have created "loss prevention" jobs. The whole career is oriented on identifying risky behavior, observing others, investigating theft, and finding methods of reducing risk. In retail, they may be secret shoppers; in transportation they may be monitoring cameras and patrolling as guards, or dressed in business suits advising in board rooms.</P><br /><P> </P><br /><P>Information technology (IT) and lessons from business intelligence (BI) can be applied to detecting and preventing theft. For the internal threat, access can be controlled by badge or biometrics. Capabilities of these can limit access by employee, time of day, and certain days of the week. For example, employees that work in the warehouse can access their warehouse doors, but cannot gain entry to the supply department. Those who have janitorial privileges with their access cards can only do so during work hours and not when the business is closed.</P><br /><P> </P><br /><P>Other IT help includes closed circuit television (CCTV). This is a great deterrent and detection device for both the internal and external threat. Current technologies allow the use of tilt/pan/zoom cameras that can record digital data for months. This data can be reviewed to see the habits and patterns of suspect customers and employees. All of this leaves a data trail that can be put into a data warehouse. Besides employee protection and assistance roles, this data can be mined to see patterns and recognize traits of potential perpetrators. For example, a supply bin in a warehouse may suffer shortage at each inventory. The installation of a CCTV device would provide digital feedback of whether or not supplies are being stolen and who is doing the stealing.</P><br /><P> </P><br /><P>Sabotage and vandalism is a constant threat and can be categorized with workplace violence, criminal trespass activities, and industrial espionage or in conjunction with a theft. Though it is a rare, its costs are heavy and depending where in the supply chain the product is, the expense may fall on the company or the customer. Here supply chain is a generic term, but is used to identify an IT tool that provides and automated tracking of inventory and information along business practices. These practices can include campuses, apartments, retail, transportation, factories and other industries.</P><br /><P> </P><br /><P>Security solutions to detect and prevent include monitoring the workplace and removing the internal threat, building security in depth to prevent the external threat, training employees on operation security, and employing loss prevention techniques. Other effective measures against vandalism and sabotage include volunteer forces, employee incentive programs and other organizations such as neighborhood watch programs. Industry, churches, community activity centers and schools have learned the value of relying on volunteers. Volunteers serve as force multiplies that report criminal activities like vandalism to the proper authorities.</P><br /><P> </P><br /><P>Employee workplace violence makes huge headlines for a very good reason. It is shocking behavior with the most serious events resulting in multiple deaths. These incidents lead to law suits, low morale, a bad reputation for the company and leaves families and victims devastated. In 2003, workplace violence led to 631 deaths, the third leading cause of job related injury deaths (BLS).</P><br /><P> </P><br /><P>This is acts of abuse physical or verbal that is taken out on employees, customers or other individuals at a place of business. For the purpose of this paper, the workplace is identified as a corporate building, warehouse, gas station, restaurant, school, taxi cab or other place where people engage in business.</P><br /><P> </P><br /><P>Not all violence in the workplace end in death. They range from simple assault to much worse. What ever the level of crime, innocent people are attacked at the work place. In the corporate world this may be shocking. In other industries like law enforcement, retail sales and health care systems it is much different. These three have the most incidents. The US department of Justice conducted a study on workplace violence from 1993 to 1999. In this study they found that 1.7 million workers fell victim to many types of non-fatal crime. These crimes include, rape, assault, robbery, and sexual assault. These studies don't always mean employee on employee violence, but include outsider on employee violence and vice versa (DETIS).</P><br /><P> </P><br /><P>Concerning homicides at the workplace, it is very expensive. For the risk of sounding cold, the average mean cost of a work related homicide from 1992 to 2001 was a round $800,000. The total cost of homicides during those years was almost $6.5 billion (ASIS). These cold hard facts derived from the National Institute for Occupational Safety and Health (NIOSH) are what industry must deal with in creating their risk management plan. It is a tough but necessary evil that must be calculated.</P><br /><P> </P><br /><P>When dealing with these facts and creating a mitigation plan, industry has to make choices to protect the workplace. The company has two obligations. The first includes the legal responsibility of the employer to protect and safeguard against preventable harm. This includes all those who work in or visit the workplace. The second responsibility is to handle incidents and investigations, discipline and other processes appropriately (ASIS). It is as important to respect the rights of all persons involved throughout the prevention and investigation processes.</P><br /><P> </P><br /><P>All departments in the enterprise are involved in the prevention and detection. All can contribute to the design, construction, and use of the data warehouse necessary for executing this type of prevention and detection. Each part could maintain a data mart with senior managers mining from the entire warehouse. In this scenario, all team members would build the data base with discriminating features. Alone, these features would probably not mean much, but any behaviors or habits when combined, may identify an abuser.</P><br /><P> </P><br /><P>The more serious discriminators would be identified and "non-hire" criteria. For example, one discriminator that would prevent a person from getting a job would be a history of violence. This would be identified in during the employee pre-employment screening phase. Another would be specific questions about performance during the interview that might indicate propensity for violence or not being able to work well with others.</P><br /><P> </P><br /><P>By building these rules, all sources could contribute to the database to identify high risk people throughout the employment. Rules could be input that when breached, could help management make a determination of who might be a threat to harmony in the workplace. For example, HR can input results of pre-employment background checks, job interview records and disciplinary actions within the company. Managers could provide information from performance reviews about questionable comments. Employees could make anonymous tips about other employees concerning their behavior.</P><br /><P> </P><br /><P>Employees' may not be the threat. Nature of customers, friends and family members could provide risk to the work place. These criteria could be identified as well. Employees who have abusive partners or spouses and employees who perform in risky environments such as retail must be considered in the risk analysis and data warehouse input.</P><br /><P> </P><br /><P>Some additional mitigating factors for employee workplace violence include traditional security methods. Additional lighting in darker areas, an armed guard, security cameras and panic alarms do wonders to give employees a peace of mind as well as help prevent violent behavior. Knowing security is in place deters the criminal element. These security measures could be linked in a network to provide feedback and evidence for use in analyzing and determining actions to prevent this behavior.</P><br /><P> </P><br /><P>Occupational fraud describes the use of "one's occupation for personal enrichment through the deliberate misuse of resources or assets" (ACFE). Whether an employee feels entitled to his fair share, is disgruntled or other reasons, this crime is costly. The median cost to business for this scheme is $159,000. Some reported fraud cases have cost upward of $1 billion (ACFE). Fraud accounts for approximately five percent of losses of their annual revenues or $652 billion in fraud losses.</P><br /><P> </P><br /><P>This crime can be broken down into three categories: Asset misappropriation, corruption, and fraudulent statement. Examples of asset misappropriation include fraudulent invoicing, payroll fraud, and skimming revenue. Corruption can involve bribery and conduction business laced with undisclosed conflict of interest. Fraudulent statement covers booking fictitious sales and recording expenses in the wrong period (ACFE).</P><br /><P> </P><br /><P>Fraud losses affect small business the greatest. For example, compared to the median loss of all businesses, small businesses suffer median losses of $190,000. Losses like these can devastate an unwitting company and fraud can continue for 18 months before being detected (ACFE). Whenever possible, business should focus on reducing both the mean cost of a fraud incident as well as the time it takes to reduce the fraud discovery timeline.</P><br /><P> </P><br /><P>Out of all industries, fraud causes the highest median losses per scheme in whole sale trade, construction and manufacturing. Government and retail has the lowest losses per scheme (ACFE). These industries have a huge impact on costs of finished product. Wholesale trade, construction and manufacturing all wrap up the costs in the final product. Of course the costs aren't recovered immediately. In construction and some manufacturing, the jobs are bid on and regardless of losses; the project must be completed at or below cost of bid. However, later bids may be higher as a result to gain back costs.</P><br /><P> </P><br /><P>Believe it or not, the position of who commit fraud is directly related to the cost of the fraud. For example, the losses caused by owners or executives in a business are 13% higher than the losses caused by employees (ACFE). Managers may not be sticking product in their pockets and sneaking out the door. People in higher positions can be found falsifying travel reports, creating false accounts, diverting payment and other crimes. Some of this is evident as we continue to prosecute chief officers involved in huge schemes.</P><br /><P> </P><br /><P>Fraud is difficult to detect and many schemes can continue for long periods of time before they are detected. Detection can be accidental, the result of a tip, an audit (internal, external or surprise), hotline or as referred to by law enforcement. Focus and discipline could be perceived as the best means to detect fraud. Paying attention to patterns, verifying paperwork and checking records is time consuming, but must be performed.</P><br /><P> </P><br /><P>The most successful but less used method to detect fraud involves the input of employees. Training employees on fraud and awareness cuts down on the time span of a fraud as well as the overall cost. Training increases morale in many ways and creates a team like atmosphere. Business can gain from the proper training. Employees are a great resource in fraud prevention. There has been great success with using hotlines and anonymous reporting to detect and deter fraud (ACFE).</P><br /><P> </P><br /><P>Information technology (IT) and lessons from business intelligence (BI) can be applied to detecting and preventing fraud. We have already mentioned that employee and hotline tips are most effective but business doesn't take advantage of this. Computer links could be set up on corporate sites to allow employees to report fraud. Some methods could include survey, direct question and answer, or just a space for reporting.</P><br /><P> </P><br /><P>The audit, hotlines and tips are effective after or during the commission of the lengthy fraud period. These are all reactionary events. What about being proactive? Many companies have the capability to automate almost everything. Time sheets, accounting, billing, production and supply chain records are often on a server. Most require supervisor approval or at the very least have the capability of real time monitoring. This information can be integrated into a company version of a data warehouse and be manipulated according to the input rules. Specific habits of employees can be pulled to look for and address financial inconsistencies.</P><br /><P> </P><br /><P>As mentioned earlier, businesses have employed access control measures such as card scanners, code readers and biometrics. They leave a trail of employee activity and regardless of position all are required to enter information to gain entry. Computer keyboard activity can be limited by password protection and all media should go through the security department before introduction or removal. All of this leaves a data trail that can be put into a data warehouse. Besides employee protection and assistance roles, this data can be mined to see patterns and recognize traits of potential perpetrators.</P><br /><P> </P><br /><P>Finally, computer attacks are a huge risk to all businesses. The threat of hackers, malicious viruses, and those who hijack websites and hold financial transactions for ransom are just a few serious events of which the security manager must the aware. Data can be destroyed, reputations can be ruined, and lives can be stolen. These attacks can cripple an enterprise and could take months or years to recover. Businesses need to have IT tools to detect and combat this type of threat as soon as possible. Identity protection and other computer related incidents requires the same type of protection afforded to an employee as in the section about employee workplace violence.</P><br /><P> </P><br /><P>Worms and viruses are quickly destroying years of input. These threats appear innocently enough in the beginning and when the right time comes, they activate. They recreate themselves, and spread through out networks and stand alone systems. Hackers continually knock at the internet portal trying to learn passwords and the inner most secrets of protect to exploit for espionage, theft or horrible fun. Hijackers enter a system and threaten to cripple financial transactions until payment is made; extortion in high-tech form.</P><br /><P> </P><br /><P>Unprotected systems perpetuate all the above threats. Businesses that get involved either innocently as naive contributors or as the hapless victims suffer greatly financially and productively. There is another cost that could take longer to recover from. This is the of their valuable reputations with their customers. A technically illiterate or unprotected business has no excuse when dealing with customers or partners. Embarrassing things happen when a virus or cyber trail leads to a witless company. Industry cannot take the risk.</P><br /><P> </P><br /><P>There are many existing security methods available to help companies take the offense against such attack. As the in the above examples, this effort takes the coordination, input and involvement of all business units and departments in the organization. This cannot be given to the security department alone to handle, however such actions should be accountable to one department.</P><br /><P> </P><br /><P>There are new positions created called Chief Security Officer (CSO) and Chief Information Officer (CIO). The hot new topic for these positions is convergence. Convergence is the alignment of physical and information security under the same department. According to CSO Magazine, this should be run by one point of contact being the CSO. This can align physical security, information security, compliance and privacy under one function. This enables the security executive to address Insurance Portability and Accountability Act and Sarbanes-Oxley with focus and intent (CSO Online).</P><br /><P> </P><br /><P>Other aggressive measures that can be taken are password protection, rules on internet use, firewalls and internet access blocking. These can be regulated with the convergence concept. Software already exists to help generate and protect passwords on network and stand alone systems. These help ensure not only that authorized users are accessing the systems, but they also provide a basis for auditing systems. This is vital to protect a company from the threat of social engineering. Information technology can track who used which system to access which information. The user leaves an automatic automated electronic trail.</P><br /><P> </P><br /><P>Companies need a firewall to protect information from both leaving and entering the enterprise system. These firewalls help prevent hacking, high jacking and malicious viruses. The firewall needs to be updated regularly with updates. Most importantly, the CSO or CIO should be checking and running analysis identifying the threat. This analysis of threat and defenses can be conducted the same way as military strategy.</P><br /><P> </P><br /><P>This identification should track where the threat is coming from, how often the defenses are probed, what the threat using to probe the defenses is, and what times of day are the threats the strongest. For operations security, the chief should look at what makes their business so tempting to the threat.</P><br /><P> </P><br /><P>When a chief information or security officer analyses his own operation, they should be trying to identify strengths and weaknesses that the adversary is trying to exploit. When is the IT asset most vulnerable? Are our passwords easy to break? How much intrusion would it take to stop our operations? Are just a few questions that must be analyzed along with external threat analysis.</P><br /><P> </P><br /><P>Internet discipline is also vital. An enemy doesn't have to break down your defenses to wreak havoc. Just like old vampire lore, all you have to do is invite them in. When employees visit unauthorized websites, download unauthorized software, transfer data from a home computer or forward corrupted email, they can cause just as much harm. Blocking websites, allowing only IT personnel to upload software, and screening all mobile media or preventing all media such as CDs and other portable storage devices is crucial to protecting the enterprise.</P><br /><P> </P><br /><P>As mentioned in other paragraphs, protecting your company with security in depth will solve many problems. This security in depth includes previously mentioned biometric or card reader access devices, alarms and CCTV cameras. These are available IT devices that are popular and effective at monitoring employee movement and activity. The chief can also store vital risk assessment detail in a data warehouse to better analyze events and proactively mitigate risks before damage occurs.</P><br /><P> </P><br /><P>As mentioned throughout this paper, somebody needs to take charge of organizing a multiple business unit task force to protect the company. Traditional methods of segmenting units and having them work in a vacuum do not produce effective results. When the IT department handles all internet activity, human resources execute the laying off offenders, finance department handle all payroll discrepancies and accounting performs all audits, the result is a broken chain of incomplete activity.</P><br /><P> </P><br /><P>The willing participation and information sharing is better handled in the form of a committee. Each respective department can do their day to day activities, but results can be presented to the entire group to help detect and determine any one of the threats addressed in this paper.</P><br /><P> </P><br /><P>We began with the news reports of businesses needing to protect their personnel and the assets. We showed examples from the headlines of people coming to places of business to conduct senseless acts of terrorism and violence and the need for having a corporate culture or environment to address the different types of threats. This culture involves quickly evolving the role of security to become the protector of personnel, facilities and product. This evolution will enable them to use IT as a tool to help detect and deter risks to the enterprise.</P><br /><P> </P><br /><P>Having said that, we can conclude that security professionals need to continue to make it a point to study their craft and learn ways to counter evolving threat. Business intelligence methods need to continue to keep up with technology to analyze and prevent the internal and external influences that can ruin the enterprise. The threats corporations face include: theft, vandalism, workplace violence, fraud, and computer attacks. We have reviewed the roles of security to converge traditional physical protection with the capabilities of IT systems. The IT can provide a great tool to enterprise as a system of identification, analysis, risk assessment operation security and prevention, astute managers can mitigate risks.</P><br /><P> </P><br /><P>Works Cited:</P><br /><P> </P><br /><P>ACFE. 2006 ACFE Report To The Nation On Occupational Fraud & Abuse, Association of Certified Fraud Examiners, Austin, TX, 2006</P><br /><P> </P><br /><P>American Society of Industrial Security, Workplace Violence Prevention and Response, ASIS International, 2005</P><br /><P> </P><br /><P>Detis. Violence in the workplace, 1993-1999. NCJ 190076. December 2001</P><br /><P> </P><br /><P>Berinato, Scott; Carr, Kathleen; Datz, Todd; Kaplan, Simone and Scalet, Sarah. CSO Fundamentals: ABCs of Physical and IT Security Convergence. CSO Magazine. [http://www.csoonline.com/fundamentals/abc_convergence.html]</P><br /><P> </P><br /><P>Cummings, Maeve; Haag, Stephen; Phillips, Amy, Management Information Systems for the Information Age. McGraw-Hill. New York, NY 2007</P>

The Need for Physical and IT Security Convergence

Business security professionals make it a point to study their craft and learn ways to counter evolving threat. Business intelligence meth...

Small Business Computer Security, the Basics

<P> </P><br /><P>Anyone in business today realizes both the natural dependency on computers in the workplace, and also the potential dangers associated with storing important data on them. Today's business owners are constantly being reminded that their company's data is at risk by the daily reports on various news stations, or even their favorite business-related website.</P><br /><P> </P><br /><P>But what can a typical small business owner do to protect their network from these threats that are broadcasted in so many ways? Dangers lurk at every turn on the Internet. There are thousands of attacks or areas of security that could be discussed, but I am going to try and focus on three general nuisances associated with today's computers: viruses, spy-ware, and traditional "hackers" that will intentionally try to exploit your computer systems for various reasons. All of these attacks, although different, serve a specific purpose for the attacker, yet basically translate into three things for a business: lost productivity, lost data, and the end result... lost money.</P><br /><P> </P><br /><P>Here is brief descriptions of what the aforementioned attacks are, consist of, and what a typical small business can do to protect their technology investments.</P><br /><P> </P><br /><P>Virus: A computer virus shares some traits with an actual virus that gets people sick. A computer virus must piggyback on top of some other program or document in order to get executed. Once it is running, it is then able to infect other programs or documents. Obviously, the analogy between computer and biological viruses stretches things a bit, but there are enough similarities that the name sticks. A computer virus can have many intentions. One common goal is the virus's desire to infect as many machines as possible. Some are harmless and are no more then an attempt for a hacker to spread their name and get recognition amongst their peers. However, this can still lead to slow computer performance or programs acting up. On the other side of the coin, viruses can be extremely harmful and delete data, cause complete computer interruption, give someone unauthorized access to your company data, or even be used in conjunction with thousands of other infected computers to launch grand-scale attacks. Viruses are still mostly transferred via email; however newer attacks will entice you via an email to a malicious website that will exploit a flaw in your computer to install the virus.</P><br /><P> </P><br /><P>Protection from Viruses: If you are reading this article, and you still do not have current (this is very important) anti-virus software running on EVERY single computer you own, then shame on you. With all of the marketing commotion that surrounds viruses, you should already have antivirus software on all of your computers. If you don't, then hurry to the store and purchase it. Popular software in the antivirus market is made by Symantec (www.symantec.com) and McAfee (www.mcafee.com). Larger companies may look into a system that will scan emails prior to the email getting to a user's inbox for viruses. Also, be wary of what you open in your email. Do not open emails from people you do not know, and even if you do know the sender, take extra caution, as most viruses today will trick you into believing that the virus is sent from someone that you know.</P><br /><P> </P><br /><P>Spyware: You may know spyware by one of its many names, adware, malware, trackware, scumware, thiefware, snoopware, and sneakware. Because of its stealthy nature, most Internet users are more familiar with the symptoms of spyware infection: sluggish PC performance, increased pop-up ads, unexplained homepage change, and mysterious search results. For virtually everyone surfing the Internet, malware and adware are a nuisance, but if you do not detect spyware on your PC, it can lead to much more serious consequences such as identity theft. Many people wonder how they get spyware installed onto their computer in the first place. Typically, spyware is installed onto your PC without your knowledge because the programs are usually hidden within other software. For example, when you are browsing a website, and a pop-up appears to install the latest online Casino game, it probably will give you that game, but you've also just installed spyware along with that. Another avenue for Spyware to infect your machine is through popular Peer-to-Peer File Sharing software such as Kazaa. The financial impact on a business that is plagued by spyware can toll very high. Costs paid to computer consultants to remove spyware, and a user's overall lost of productivity from a slow-performing computer can add up very quickly.</P><br /><P> </P><br /><P>Protection from Spyware: Spyware is a huge problem in today's computing environment. Fighting Spyware starts with smarter use of your computer. The best defense against spyware and other unwanted software is not to download it in the first place. Here are a few helpful tips that can protect you from downloading software you don't want. Only download programs from web sites you trust, read all security warnings, license agreements, and privacy statements associated with any software you download, and never click "agree" or "OK" to close a window. Instead, click the red "x" in the corner of the window or press the Alt + F4 buttons on your keyboard to close a window, and be wary of popular "free" music and movie file-sharing programs, and be sure you clearly understand all of the software packaged with those programs. If you do happen to install Spyware on your computer, there are some tools available to assist in the removal of spyware. Be careful however when downloading these "free" spyware removal softwares, as even some of the removal tools incorporate spyware into their software. A popular product that does a good job of removing spyware is Lavasoft's Adaware (www.lavasoft.com). Larger organizations can look to companies such as Computer Associates (www.ca.com) for enterprise protection. There are instances when there is simply just too much spyware installed on a machine where these tools cannot help, and you'll be forced to format your hard drive and reinstall your operating system.</P><br /><P> </P><br /><P>Hackers: The term hacker has many different meanings to many different people. A dictionary might define the word hacker as follows, "A person who breaks into, or attempts to break into, or use, a computer network or system without authorization, often at random, for personal amusement or gratification, and not necessarily with malicious intent. 2. [An] unauthorized user who attempts to or gains access to an information system 3. A technically sophisticated computer expert who intentionally gains unauthorized access to targeted protected resources, loosely, a computer enthusiast. 4. A person who uses a computer resource in a manner for which it is not intended or which is in conflict with the terms of an acceptable-use policy, but is not necessarily malicious in intent." As you can see, a hacker is someone with a very high aptitude in computing. By studying the inherent design of computer systems, a hacker will then attempt to compromise those systems for a purpose. Typically, they use a collection of tools easily downloadable on the Internet to exploit a flaw in a program or hardware system. Hackers do what they do for various reasons. Some do it for simple prestige amongst their peers, others for financial gain, and others do it to make a political statement. The impact of your network's security being breached can lead to very serious financial losses. Imagine your customer database being sold to a competitor or even what public response would be if you had to tell your customers that their personal information was stolen?</P><br /><P> </P><br /><P>Protection from Hackers: I was once told, that no matter how good a safe you buy, there will still always be a locksmith that can un-lock it. The same goes for protection against hackers. However the amount of people with the expertise to bypass most security defenses, available to companies, are few and far in between. To keep your network safe, the following three items are an absolute must. A quality firewall at your network's perimeter to filter what goes in and out of your internet connection, desktop level firewalls to keep internal company computers safe, and the importance of performing updates to your computer's operating system and applications. Firewalls simply stated, filter data passing through them. They are in essence, inspectors that allow and deny data to be passed through them based on certain rules. Most quality firewalls will protect your network by letting the good data through and keeping the bad out. Recommended firewalls for small businesses can be purchased from companies such as Cisco (www.cisco.com), Watchguard (www.watchguard.com) or Sonic Wall (www.sonicwall.com). Firewall vendors typically have many different models available, so consult with your network security professional on what to buy. The important thing is that you have one in place. Desktop level firewalls provide a true multi-layered approach to security. This added level of protection strengthens your computer systems defense, and is especially helpful to companies that have remote workers. Most companies today do have firewalls on their corporate network; however no one ever thinks about the company president's laptop that gets brought home everyday. The president brings his laptop home and sets up his trusty remote connection back into his office over his broadband home Internet connection. The once protected laptop is now completely unprotected and connected directly to the corporate office, which gives a direct avenue for virus and hackers onto your corporate network. The great thing about desktop firewalls is that you can get some great ones for free! If you use the Microsoft Windows XP operating system, simply upgrade to service pack 2 and it includes a free and easy to use desktop level firewall. If you do not have Windows XP or just do not want to use their firewall, Zone Alarm (www.zonealarm.com) offers a great desktop level firewall. The last level of defense is to keep your networked systems up to date with the latest patches and fixes from their respective manufacturers. I will assume that most companies use Microsoft Windows products for most of their computing needs, so to keep your system updated simply go to <a href="http://windowsupdate.microsoft.com/" rel="nofollow" target="_new">http://windowsupdate.microsoft.com</A>. You should check for updates twice a month.</P><br /><P> </P><br /><P>Even though this article simply brushes the surface of network security, I hope it gives you insight as to some potential dangers out there and real incentive to implement better security for your company. Just as you have an alarm system at your office, please take the necessary steps to protect your company's computer network and data. If not, the costs of recovery I guarantee you will far exceed the costs to implement a secure network.</P><br /><P> </P><br /><P>Jarrett M. Pavao studied at the University of Miami, is a Microsoft Certified System Engineer, and Citrix Certified Administrator. Jarrett is the Director of Business Technologies for Docutek, a systems integrator in Boca Raton, FL. Jarrett can be contacted at <a href="mailto:jpavao@docuteksolutions.com">jpavao@docuteksolutions.com</A> with any network security related questions or concerns.</P>

Small Business Computer Security, the Basics

Anyone in business today realizes both the natural dependency on computers in the workplace, and also the potential dangers associated wit...