Archive

Archive for April, 2006

Best practice on password management

April 29th, 2006

This morning I read a good essay named “Security Myths and Passwords” by Prof. Eugene Spafford. Prof. Eugene told us his doubt on  those  best practices on password management policy, like “monthyly change”, based on the interesting origin of this “best practice”.

The defects and even failures in most of enterprise security defense systems can be root caused into problems in “security execution”, ie. the discrepancy between the policy and the real environment. The security manager just book those best practices into their “policy”, while not considering their staff, their skills, the data to protect, the threats to contain/mitigate…

Uncategorized

Will Net Neutrality come again?

April 29th, 2006

See comment at Register, named "Net Neutrality bid gone for good" by Andrew.  A bunch of Internet giants expressed their discontent to Net Neutrality, for its mistiness and injustice. Andrew is hoping a "more coherent and professional fashion", and even "with better branding". The key point in my brain, for its possible recoming, is the benefit balance between transmission network (typically those tradional telcos) operators and CP/SPs. The latter would not like to let the former "tame" the Internet, but "foster".  

See the story by Andrew…. (more…)

Computer security Systems

Disable USB Drives

April 27th, 2006

Update 1/18/2007 09:23 PM EST – Some changes in windows have made this article out of date. Check out our new article on the subject to learn how to disable USB flash drives
Once in a while I have a friend, or customer that needs to keep people from using the USB ports to copy data off of a system.
It is easy to lock a machine down, disable the floppy, and cdrom in the bios. Many times when you try to disable USB – it disables it entirely.
This can be a real pain on newer laptops or systems that don’t even have a PS2 interface for the mouse or keyboard.
There is a simple registry change that will keep the USB storage drivers from starting when the system boots. Keeps people from walking up to a PC and copying data off with a USB key, but allows you to keep your [...]

Original post by Steve Wiseman and software by Elliott

Computer security Systems

Blog Posting 2: from the show floor at RSA Conference Japan

April 27th, 2006

Following the opening keynotes on Day 1 of the RSA Conference, I made my way over to the trade show floor. I have attended several RSA Conferences over the years in the U.S. as well as Europe, so I was expecting to see several vendors showing their wares in the exhibit hall. When I made my way into the area where the exhibit booths are displayed, however, I wasn’t sure if the pace would be quite as frenetic as when you step into the show room of the Moscone Center in San Francisco, where the RSA Conference in the U.S. is often held. I have to say though, that I was quite taken aback by all the activity in the exhibit hall here in Tokyo!
This year’s Conference featured over 60 exhibitors, with several thousand attendees visiting the trade show portion of the event. As I stepped into the exhibit hall [...]

Original post by blog@rsa.com (Shannon Kellogg) and software by Elliott

Computer security Systems

Posting 1 from RSA Conference in Tokyo

April 26th, 2006

The RSA Conference Japan kicked off in Tokyo today with an opening keynote address by U.S. statesman, Ambassador Richard Armitage. Ambassador Armitage, who served as Deputy Secretary of State for the U.S. from 2001 – 2005, began his speech by refering to the scurge of cyber-crime around the globe and emphasizing that he thinks it is very important to address cyber-crime and the threat of cyber-terrorsism now. “I can’t think of anything more important,” he told the 700-plus attendees in first general session of the 5th anniversery edition of the RSA Conference in Japan.
The standing room only audience at the Tokyo Prince Hotel Park Tower listened as Ambassador Armitage shared his assessment of security in the Asia Pacific region and what he thinks the future holds for the U.S.-Japan security alliance…

Original post by blog@rsa.com (Shannon Kellogg) and plugin by Elliott Back

Computer security Systems

About the PassMark Security Acquisition

April 24th, 2006

Just a quick heads up to point out that RSA Security today announced the purchase of PassMark Security. You may know PassMark Security as the company behind Bank of America’s SiteKey system which offers extra security to customers by displaying a secret image each time they sign in — helping assure them that the site is legitimate.
When I first learned of PassMark’s offering to BofA last year I pointed out to RSA Security’s execs that in a single move PassMark would be helping to protect nearly as many online identities — the 13 million BofA customers — as the RSA SecurID(R) authentication technology had protected over two decades (somewhere around 20 million at the time). “Different segments of customers desire various forms of protection” would be the way we’d describe it less than a year later…

Original post by blog@rsa.com (Burt Kaliski)

Computer security Systems

Speaking of Security Podcast #13

April 24th, 2006

Click here to listen/download (10:12).
We start the week with the announcement that RSA Security has enhanced its leadership in the protection of online identities and transactions through the purchase of PassMark Security. We also talk to Dr. Ari Juels of RSA Laboratories about Radio Frequency Identification (RFID), covering both the practical uses of the technology and some new security concerns. Finally we take a virtual voyage to Tokyo with Speaking of Security blogger Shannon Kellogg who is there to attend RSA Conference Japan.
Related Links:

RSA Security Acquires PassMark Security (Press Release)
More about RFID from RSA Laboratories

Original post by blog@rsa.com (Podcast Producers) and software by Elliott

Computer security Systems

Uri Rivner Joins RSA Security Bloggers

April 18th, 2006

Hello everyone,
Are you familiar with the name Cyota? Hey, no Googling please!
Well, if the name does ring a bell, I’m not very surprised. You see, while Cyota — the recent acquisition of RSA Security — is not a pure Internet Security player, it gained recognition in this space due to its anti-phishing service, which, simply put, fights online fraudsters. Cyota has also published statistics and research related to phishing and other types of online fraud for a long time, and since these have a close relation to online security you may have heard about the company…

Original post by blog@rsa.com (Uri Rivner) and software by Elliott Back

Computer security Systems

Speaking of Security Podcast #12

April 17th, 2006

Click to here to listen/download (9:12)
This week’s podcast features a Q&A with research analyst Bruce Cundiff of Javelin Strategy and Research on usability vs. security. We also detail RSA Security’s first quarter earnings and hear from RSA Security customer Jim Walker of Willow CSN.

RSA Security Announces First Quarter Results
RSA Security Protects an Increasing Number of Online Identities and Digital Assets Worldwide in the First Quarter of 2006Web Seminar: What is the Impact of Strong Authentication on Usability? Case Studies and Best Practices for Financial Institutions

Original post by blog@rsa.com (Podcast Producers) and software by Elliott

Computer security Systems

Speaking of Security Podcast #11

April 10th, 2006

Click here to listen/download (5:45)
CRN (Computer Reseller News) recently gave the RSA SecurID® Appliance a 9 out of 10 rating – hear more. And RSA Security announces plans to open a development center in Bangalore, India. Stan Swiniarski, vice president of engineering, Enterprise Solutions Group, RSA Security Inc., explains why our growing need for more engineering resources prompted the expansion.
Related Links:

CRN PRODUCT REVIEW: RSA Introduces Security The Hardware Way
RSA SecurID® Appliance 2.0
RSA Security to Open Development Centre in Bangalore

Original post by blog@rsa.com (Podcast Producers) and a wordpress plugin by Elliott

Computer security Systems

Who Sets The Audit Standards? Part 3 of 3

April 9th, 2006

Did you miss Part 1 or Part 2 of John Madelin’s Who Sets the Audit Standards?
E. What Do the Members and Stakeholders get from the Professional Body?A primary driver is to be able to demonstrate that those responsible for security are fit for the job that they are undertaking. A secondary driver is the need for organisations to be sure that they are applying sound practice. The stakeholders are therefore the individual members of the professional body, the organisations that benefit from their services, and the wider community at large—for whom a fabric of trust would ensure confidence in transactions and online behaviours…

Original post by blog@rsa.com (John Madelin) and software by Elliott Back

Computer security Systems

Who Sets The Audit Standards? Part 2 of 3

April 5th, 2006

Did you miss Part 1 of John Madelin’s Who Sets the Audit Standards?
C. The Perfect Storm — IT Conditions Conspire To Create a State of ReadinessWe can see similar environmental factors conspiring together today to re-enforce the need for professionalism in the fabric of trust supported through “good security” in its broadest sense.
The major environmental factors coalescing to create a perfect storm (in the context of profound commercial, social, cultural and economic impact) — and re-enforcing the need for a “professional body” — might reasonably be considered as follows…

Original post by blog@rsa.com (John Madelin) and powered by Img Fly

Computer security Systems