STE WILLIAMS

Sophos Announces Cloud Strategy And Endpoint Protection Solution

Oxford, UK – October 29, 2013 – Sophos today announced a strategy to deliver cloud-managed security solutions that appeal to organizations seeking a simpler approach to IT security. Sophos Cloud is an easy to use security service that provides essential protection for today’s advanced threats. This first version of Sophos Cloud provides protection at the endpoint. Easy to deploy and simple to manage, Sophos Cloud gives Sophos partners and IT managers at enterprises of all sizes the ability to manage and maintain endpoint security to protect all users, regardless of physical location, via the cloud-based service. The launch of Sophos Cloud is the first step in the company’s aggressive strategy of cloud-enabling its entire portfolio; the company continues to deliver award-winning on-premise solutions for enduser, network and server protection.

Kris Hagerman, chief executive officer for Sophos, said, “Sophos Cloud is the answer to the constant struggle IT teams face in protecting and securing their enterprises. These IT teams may be as small as a single person, but the constant threats and challenges they face could overwhelm an army. To come to their rescue, we’re thrilled to deliver Sophos Cloud – it will be one of our key strategic priorities as we execute on our vision of being the best in the world at delivering complete, powerful, and simple IT security to small and mid-market enterprises and the channel that serves them.”

With the management console hosted by Sophos Cloud, there is no server set up and service can be deployed instantly, providing complete security coverage everywhere – simply. Sophos Cloud delivers all the essential endpoint protection a company needs without any of the complexity traditionally associated with security management. The service is also consistent with Sophos’ ongoing focus and commitment to be a “Channel First” company.

“The ability to administer our security with Sophos Cloud allows us to better manage our resources and enables us to effectively utilize our time and money. The service was easy for us to implement, and it seamlessly integrated into our environment,” said David Fox, IT Consultant, Neptune Terminals.

“Small and medium businesses are especially challenged regarding IT security. They are targets and must meet security best practices yet are resource constrained,” said Charles Kolodgy, Research Vice President for IDC. “Sophos Cloud is a welcome addition. Its features can remove some of the complexity tied to security management thus allowing small and mid-market businesses to improve security without taxing their resources.”

“As an organization that specializes in IT security and services, M3Corp has had a valuable partnership with Sophos for more than 4 years. Sophos Cloud will help us extend that partnership to quickly deliver cloud security that is easy to deploy and manage, while providing the most efficient and economical security solution to all of our customers throughout Brazil. M3Corp’s partnership with Sophos ensures that our customers will be fully protected from all types of threats,” states Antonio Mocelim, Sales Director, M3Corp.

Availability

Sophos Cloud is currently available. Online 30-day trials are available by visiting: www.sophos.com/cloud

About Sophos

More than 100 million users in 150 countries rely on Sophos’ complete security solutions as the best protection against complex threats and data loss. Simple to deploy, manage, and use, Sophos’ award-winning encryption, endpoint security, web, email, mobile and network security solutions are backed by SophosLabs – a global network of threat intelligence centers.

Article source: http://www.darkreading.com/end-user/sophos-announces-cloud-strategy-and-endp/240163300

Surveillance Issues Overshadow Talks At End Of Internet Governance Forum 2013

Bali, Indonesia, 25 October 2013 – As a stream of surveillance revelations continues to seize the attention of governments and public opinion alike, the largest global multistakeholder meeting on Internet governance, known as the IGF, concluded today in Bali, Indonesia, by confronting surveillance as the major “emerging issue” of the year.

Referred to as “the elephant in the room” in the opening session, the issue of surveillance cast a long shadow over the discussions at the four-day forum – a UN-convened annual meeting that drew more than 1,500 representatives of governments, civil society, technical community and private sector from 111 countries, with hundreds more participating remotely.

A number of the IGF’s 135 workshops and focus discussions made reference to “restoring trust” in the Internet and the potential dangers of retrenchment from an open Internet by nations concerned about the security and privacy of their digital communications. During the final focus session, in response to a comment coming in on twitter, moderator Jovan Kurbalija, referred to the forum’s “serious determination and responsibility to do something useful for Internet as a whole, and for humanity, first of all to avoid the situation like this one with the NSA case, but also to prevent similar situations happening worldwide.”

U.S. State Department Representative Scott Busby said that the United States recognizes the many concerns on the issue of surveillance and “welcomes a discussion about privacy and security, and we are right now intensively having that discussion,” adding that the issue of surveillance global should “take into account the views and practices of everyone around the world.” Addressing the nexus between the surveillance and violations of human rights, Mr. Busby said that the U.S. “does not use intelligence collection for the purpose of repressing the citizens of any country for any reason, including their political, religious, or other beliefs,” adding that “individuals should be protected from arbitrary or unlawful State interference.”

The issue of trust was picked up by Ross LaJeunesse of Google, who said “if our users don’t trust us, they won’t use our products, and they’ll go somewhere else.” Part of maintaining that trust, Mr. Lajeunesse maintained, is “not provide direct access for any Government to our data, our servers, our infrastructure”, and not to accept “large, blanket-like Government requests for user data.” He urged participants to hold all governments accountable to the highest standards, including those “where journalists are beaten, bloggers are imprisoned and activists are killed.”

Speaking from a technical perspective, Jari Arkoo of the Internet Engineering Task Force (IETF), offered what he called a “do not panic” message, which included the view that surveillance is a widespread problem that has been around for a long time, but that given today’s challenges “once again Internet technology needs to evolve” to ensure an Internet that protects privacy concerns while remaining open and global.

To strengthen trust “the principles of rule of law, transparency, and also respect for Human Rights” must be reinforced according to Johan Hallenborg of the Foreign Ministry of Sweden, a country that has introduced constitutional framework protections in the digital privacy area. An equally important aspect to protecting rights and freedoms of individuals from abuse of others, is the ensuring that “the State itself does not violate rights and freedoms — in other words, setting the limits for state power,” he said. Fundamental to this exercise, Mr. Hallenborg added, is to ensure the separation between “surveillance of electronic communication by law enforcement agencies” and “intelligence collection by security agencies.” At the recent Seoul Conference on Cyberspace Sweden’s Prime Minister Carl Bildt presented several fundamental principles to maintain respect for Human Rights when carrying out surveillance of electronic communications, Mr. Hallenberg said, stating that these include: “legality, legitimate aim, necessity and adequacy, proportionality, judicial authority, transparency, and public oversight.”

“Trust among Governments and in the major ICT and Telecom companies is completely broken” as a result of unauthorized data and metadata collection, said Joana Varon of the Centre for Technology and Society in Rio de Janeiro, representing civil society organizations, adding that was time to move forward with solutions. In this regard, Ms. Varon mentioned that the Civil Rights Framework for the Internet in Brazil (‘Marco Civil’) as “a model in terms of both content and process” that could provide a useful guide in an international scenario. Ms. Varon invited representatives of other countries to consider the “International Principles on the application of Human Rights to Communication Surveillance”, which in addition to some of the principles in Sweden’s seven-point list also include “user notification, transparency, and public oversight.”

Kicking off the comments from the floor, Amb. Benedicto Fonseca Filho of Brazil said he would “align” his statement with the one delivered by Joana Varon, reiterating Brazilian President Dilma Rousseff’s call to the international community to launch a process that would achieve principles and norms to guide use and operation of the Internet. The proposed Summit meeting in Brazil next year aims to accelerate this process while maintaining a multistakeholder approach, he said.

Additional comments included the notion that developing principles to deal with surveillance is “necessary but not sufficient,” and that what is needed is “due process and oversight.”

Commenting that the damage done by unauthorized surveillance was much larger than was being acknowledged, one speaker said that “a cancer scare does not get treated with an aspirin.”

“Some individuals countries are carrying out large-scale surveillance over other countries,” said Mr. Ren Yishen of the Foreign Ministry of the People’s Republic of China, calling this “an infringement of sovereignty and privacy that also poses a threat to the safe operation of the Internet.”

While surveillance is troubling for governments and the public alike, some speakers emphasized that the reaction may also be “very troublesome,” as calls for “data sovereignty” could present extreme technical challenges and could stifle local industries. Demand for “keeping data local” would likely lead to blanket requirements that would harm innovation in the Internet, another speaker said.

A former member of Parliament from Germany questioned the treatment of people who encrypt their data as “potential terrorists.” He went on to describe the need, among other things, for international contracts to ensure that “friends don’t spy on friends,” and received applause when calling for encrypting all communication so that surveillance will not work. The session’s loudest applause was heard for a comment from a representative of the Center for Technology and Democracy: “I’ve not lost my trust in the Internet,” Matthew Shears said, “I’ve lost my trust in the institutions that use the Internet for the purposes of undermining my fundamental rights.”

Session Chairman Dr. Setyanto P. Santosa, Chief of the Indonesian Information and Communication Technology Association, called it “the top of the top sessions” at the IGF, and Mr. Markus Kummer of the Internet Society, who had chaired the IGF preparatory process, commented that by addressing such a sensitive issue the multistakeholder Forum had “proved its value and its worth.”

The four-day IGF 2013 meeting was capped by a closing ceremony that reaffirmed the participants’ belief in maintaining and strengthening the multistakeholder approach to discussing governance on the Internet, as opposed to a government-led multilateral approach. It also focused with a wider lens on emerging issues in Internet governance, beyond the surveillance issue.

“New cybersecurity threats and revelations of widespread Internet surveillance are only two of emerging issues that the multistakeholder community must address,” said Elia Armstrong of the United Nations Department of Economic and Social Affairs (UNDESA), underlining the need for these multistakeholder deliberations to also feed into the broader processes for global agenda for sustainable development post-2015 and the “WSIS +10” review.

Anne-Rachel Inn, Chief Operating Officer of AfriNIC, expressed the hope that the “open and collaborative spirit of Internet cooperation” of IGF 2013 in Bali would be maintained in future meetings and negotiations, noting that “it is needed for the further evolution of Internet governance in all discussions going forward.”

“Now, more than ever, it is time to reenergize the concept and practice of consultative multistakeholder governance,” said Mr. Virat Bhatia, Chairman, Communications and Digital Economy Committee, of the Federation of Indian Chambers of Commerce and Industry (FICCI) on behalf of the business community. “Business opposes a multilateral or intergovernmental approach to Internet Governance,” he said.

Shita Laksmi, of HIVOS-Indonesia and part of the IGF 2013 Indonesian Organizing Committee, said it was important to recognize that “management of the Internet is not just a technical matter” , and that “multistakeholder principles should be reflected in our work from the beginning to the end,” including the Forum’s organizational aspects. Acknowledging that 2013 IGF preparations had not been easy, Semmy Pangerapan of APJII and the IGF 2013 Indonesian Organising Committee said that the process demonstrated how “open dialogue and an open mind can serve a solid ground for multistakeholder Internet Governance practices, which we believe is a triumph for a future generation of Internet users.”

On behalf of civil society, Keisha Taylor from Trinidad and Tobago said that “lesser developed economies and rural areas must continue to be discussed so that progress can indeed be made, and the next billion users from across the globe can also connect and not be left behind.”

Dr. Ashwin Sasongko, Director General of the Ministry of Communication and Information Technology of Indonesia, closed the session with a reminder that Internet governance is a multistakeholder responsibility that in Indonesia’s view “should be able to maximize the positive activities and minimize the negative activities in the Internet,” to create a safe, secure and tolerant cyberspace.

For more information visit: www.intgovforum.org/cms/ follow @intgovforum #IGF2013

Article source: http://www.darkreading.com/privacy/surveillance-issues-overshadow-talks-at/240163301

Waterfall Security Introduces FLIP And Modular Solutions, Expands Mission

New York – October 22, 2013 – Waterfall Security Solutions (Waterfall), which specializes in critical infrastructure and industrial control systems security, announced today the launch of two new technologies: the Waterfall FLIPtrade and the Waterfall Modular architecture. The technologies, in addition to the recently announced Waterfall for Bulk Electric System (BES) Control Centers solution, represent an expanded mission for the company: to replace control system firewalls with stronger alternatives. The solutions highlight the diverse ways that Unidirectional Security Gateway technology can meet the needs of control system administrators of power grids, oil and gas plants, water systems and pharmaceutical manufacturers. All three Waterfall products enable secure IT/OT integration and ensure the safety and reliability of critical control system networks, dramatically reducing the risk of a cyber attack occurring on critical infrastructure.

Waterfall’s core technology is the Unidirectional Security Gateway that replicates servers reliably and in real time via hardware-enforced unidirectional communications. Waterfall FLIPtrade is a Unidirectional Security Gateway that temporarily reverses gateway orientation under the control of the protected network to allow occasional external inputs, such as production plans and equipment control schedules. Additionally, the Waterfall FLIP for Substations applies the FLIP technology to secure DNP3 protocol communications for high-voltage transmission substations. The new modular architecture reduces rack-spaces requirements for Unidirectional Security Gateway and FLIP solutions, and provides for end-user replacement and expansion of gateway equipment, without compromising security or enabling covert channels.

“Replacing control system firewalls with stronger technology that leverages Unidirectional Security Gateways will put critical infrastructures in a better position to face today’s threat environment,” said Andrew Ginter, Waterfall’s vice president of industrial security. “Waterfall’s new, expanded mission is to populate the spectrum of stronger-than-firewalls technologies and solutions.”

Rounding out the trifecta of stronger-than-firewall technology is the Waterfall for BES Control Centers solution, which leverages hardware-enforced Unidirectional Security Gateways to replicate inter-control-center protocol (ICCP) servers in two directions, deployed as two completely independent communications channels. Since the gateways replicate ICCP servers instead of forwarding packets as firewalls do, the gateways do not suffer from the many, well-known vulnerabilities that plague firewalls.

Resource station:

Articles, whitepapers webinars: http://www.waterfall-security.ca/resources/

Twitter: @WaterfallSecure – https://twitter.com/WaterfallSecure

Facebook: https://www.facebook.com/pages/Waterfall-Security-Solutions/454902081249354

About Waterfall Security Solutions

Waterfall Security Solutions Ltd. is the leading provider of stronger-than-firewalls solutions for industrial control networks and critical infrastructures. The company’s products are deployed in utilities and critical national infrastructures throughout North America, Europe, Asia and Israel. Waterfall’s technologies reduce the cost and complexity of compliance with NERC-CIP, NRC, NIST, CFATS and other regulations, and include support for leading industrial applications, including the OSIsoft PItrade Historian, the GE Proficytrade iHistorian, Siemens SIMATICtrade/Spectrumtrade solutions and GE OSMtrade remote monitoring platforms, as well as OPC, Modbus, DNP3, ICCP and other industrial protocols. Frost Sullivan describe Waterfall’s solutions as ensuring “optimum security for networks across user verticals” and awarded Waterfall the 2012 Network Security Award for Industrial Control Systems Entrepreneurial Company of the Year and the 2013 North America Award for Customer Value Enhancement. For more information, visit www.waterfall-security.com.

Article source: http://www.darkreading.com/perimeter/waterfall-security-introduces-flip-and-m/240163284

New AlgoSec Study Uncovers Application Connectivity Management Challenges Are Impacting Security And Business Agility

Boston, MA – (October 29, 2013) – AlgoSec, the market leader for Security Policy Management, today announced the results of “Examining the Impact of Security Management on the Business,” a global survey of 240 information security professionals, network operations and applications owners. The survey was conducted to determine how security management affects organizations’ agility with regards to connectivity of critical applications in the modern data center. A key finding in the study shows that while many organizations are planning to migrate critical business applications from physical infrastructure to private, public or hybrid clouds, more than two-thirds of organizations encounter application connectivity disruptions or outages during data center migration projects.

“Critical business applications fuel today’s data centers, but security teams lack visibility on how security activities impact the business,” said Nimmy Reichenberg, Vice President of Marketing and Business Development, AlgoSec. “As a result, provisioning connectivity for data center applications is time-consuming, severely hampering business agility and increasing the risk of business disruptions and security breaches caused by errors in firewall configuration… and as our study shows, these challenges are magnified when migrating applications or entire data centers to the cloud.”

Key findings from “Examining the Impact of Security Management on the Business” include:

More data center applications, less business agility– Over 32% of respondents reported more than 100 critical business applications in their data center and 19% said they had more than 200 critical applications. Half of the respondents require more than 5 weeks to deploy a new data center application, while a 25% require more than 11 weeks.

Fast and furious application connectivity updates, but processed slowly – Nearly half of organizations (45 percent) have to manage more than 11 business application connectivity change requests every week, and 21% must manage more than 20 changes per week. However, 59% say it takes more than 8 hours to process each application connectivity change request with 31% saying it takes more than one business day per change.

Decommissioning data center applications is painful… and risky – When decommissioning applications in their data centers, 59% of respondents said they have to manually identify which firewall rules to change, while 15% leave the unnecessary access rules in place, creating security risks.

Prioritizing network vulnerabilities by business applications is a new requirement– Organizations want the ability to prioritize network vulnerabilities by business application. Nearly half (48 percent) of respondents want to view risk by the business application versus 31% by network segment or 21% by server/device.

Firewall audits require increased man-hours – Seventy-four percent of respondents said they spend more than 1 man-week on firewall audits per year and over 46% spend more than 2 man-weeks per year taking resources and time away from more strategic and valuable efforts of the business.

Article source: http://www.darkreading.com/management/new-algosec-study-uncovers-application-c/240163306

ForeScout Teams With SAP To Secure BYOD And Complete Enterprise Mobility

CAMPBELL, Calif. October 29, 2013–ForeScout Technologies, Inc., a leading provider of pervasive network security solutions for Fortune 1000 enterprises and government organizations, today announced interoperability between ForeScout CounterACTtrade network security and SAP Afaria mobile device management (MDM) platforms. The combination enables companies to accelerate and fortify the provisioning, administration and security of corporate and personal mobile devices, applications and data in the enterprise.

“Organizations are looking for an integrated approach to manage and secure the invasion of employee-liable devices connecting to corporate networks, particularly at a time when BYOD is so prevalent,” said Chris Hazelton, research director for mobile and wireless at 451 Research. “We see strong synergy between network access control (NAC) and MDM in their capabilities to provide visibility into devices regardless of ownership – corporate or personal. The pairing of NAC with MDMtechnologies offers organizations the means to easily identify who and what type of device is connecting to the enterprise, to automatically enroll and monitor roles-based controls for any device and user and to secure the growing movement of corporate data across smartphones and tablets.”

“IT organizations want to rapidly and cost-effectively adopt BYOD without compromising security – giving appropriate access to corporate resources, data and applications that take full advantage of mobile platforms and cloud ubiquity,” said Gil Friedrich, vice president of technology for ForeScout. “Through this integration, SAP customers can utilize the rich enterprise mobile device, data and application management provided by SAP Afaria with advanced network visibility and control afforded by ForeScout.”

Together, ForeScout CounterACT and SAP Afaria offer enterprises the means to:

See and detect all unmanaged, corporate and personal mobile devices, such as iPads, iPhones and Androids and other devices attempting to connect to the corporate network via Wi-Fi or over-the-air

Readily apply security policy based on user, role and device in order to automatically limit access, manage as guest or enroll in SAP Afaria MDM

Trigger SAP Afaria to profile check managed devices upon network resource request to detect jail-broken, rooted and non-compliant handhelds and to restrict access until the device adheres to policy

Fortify a range of user, device, application and data policies though network-enforced controls, such as password strength, configuration, application use, encryption and data protection

Provide powerful compliance rules engines at the device and network level, that support on-demand and automated responses such as reconfigure, remote wipe and network reassignment

Provide unified visibility and reporting for all mobile endpoint devices including PCs, smartphones, tablets and laptops through the ForeScout CounterACT platform

The integration between ForeScout CounterACT and SAP Afaria MDM is provided via the ForeScout MDM Integration Module, which is an add-on to ForeScout CounterACT, the company’s award-winning network security solution. ForeScout CounterACT is a real-time security solution that delivers complete visibility and automated control for all devices, users, systems and applications attempting to connect to or on an enterprise network – wired or wireless, managed or unmanaged, PC, VM, embedded or mobile.

To learn more about the ForeScout CounterACT, SAP Afaria approach, users and partners are invited to download a solution brief and attend a joint webinar to be held Nov. 18, entitled “Securing Successful BYOD and Enterprise Mobility” by registering athttp://www2.forescout.com/sap_afaria.

Article source: http://www.darkreading.com/mobile/forescout-teams-with-sap-to-secure-byod/240163307

Apple introduces "cloudless dictation", no longer demands your contact list to understand you

Not everyone was happy about Apple’s terms and conditions when it introduced dictation to OS X 10.8 (Mountain Lion).

Speech-to-text was done in the cloud, so Apple got to listen to what you were saying.

In fact, Cupertino didn’t just processs your data off-site.

It collected a bunch of other information about you and your contacts, and hung onto this data and your recorded utterances for an unknown amount of time:

When you use the keyboard dictation feature on your computer, the things you dictate will be recorded and sent to Apple to convert what you say into text and your computer will also send Apple other information, such as your name and nickname; and the names, nicknames, and relationship with you (for example, “my dad”) of your address book contacts (collectively, your “User Data”). All of this data is used to help the dictation feature understand you better and recognize what you say. It is not linked to other data that Apple may have from your use of other Apple services.

At the time of Mountain Lion’s release, we acknowledged why this might be useful.

We wrote at the time that “names are notoriously difficult to recognise and spell correctly, since they frequently don’t come from the same linguistic and orthographic history as the language of which they’ve become part. The Australian mainland’s highest point, Mount Kosciuszko, is a lofty example.”

But we also wondered why it was compulsory.

After all, giving Apple’s Dictation app access to the names of my friends wouldn’t help a jot with dictating this article, for example, nor would it help with any of a huge range of other tasks for which I regularly use my computer.

There were also other problems with a pure-play cloud approach, notably due to latency.

No matter how much beefier Apple’s server farms might be, even than your quad-core Macbook Pro, you have to add the round-trip cost of uploading your digitised voice and fetching back the results.

So the cloud-style dictation just didn’t work like the movies, where words pop up, well, word-by-word as you talk.

Instead, dictation was bursty, and limited to 30 seconds of speech at a time. (That’s only about 70 words, assuming you talk really quickly – and intelligibility drops off with speed.)

Recently, of course, yet another reason for not doing your dictation via the cloud has emerged: the perceived extent of governmental snooping of your on-line activity and the data you generate while you do it.

So here’s some good news if you have updated to OS X Mavericks: offline dictation.

As you can see, the verbiage we quoted above above now reads like this:

When you use Dictation, you can choose to have either your Mac or Apple’s servers perform the speech recognition for you. If you use Mac-based Dictation, your computer will convert what you say into text without sending your dictated speech to Apple. If you use server-based Dictation, the things you dictate will be recorded and sent to Apple…

Additionally, it seems that whenever you switch from server-side voice processing to local dictation, Apple throws away anything its dictation engines may been keeping about you, which is handy to know.

It looks as though this change, introduced in Mavericks, has nothing to do with Edward Snowden and PRISM, and everything to do with quality and usability, since it’s called Enhanced Dictation.

This comes at the cost of a whopper up-front download – 381MB for English (Australia) – that doesn’t seem to have a cancel option if you start it and then change your mind about the bandwidth.

But the new option is not only more private, it also removes the burstiness of cloud-based dictation, giving you “offline use and continuous dictation with live feedback,” which is probably what you expect of a 21st century dictation solution.

And there you have it: there ARE some things that work better without the cloud!

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/mCGvpHsTOYs/

Anonymity is the ENEMY of PRIVACY, says RSA grande fromage

Email delivery: Hate phishing emails? You’ll love DMARC

RSA Europe 2013 A dogmatic allegiance to anonymity is threatening privacy, according to Art Coviello, executive chairman of RSA.

Coviello cast anonymity as the “enemy of privacy” because it gives “free reign to our networks to adversaries” with “no risk of discovery or prosecution.”


The head of EMC’s security division told delegates at the RSA Conference Europe that security and privacy need to be aligned like two poles of a magnet in a trusted environment for internet commerce to flourish.

An imbalance between privacy and security was causing customers decisions to deploy Big Data technologies that could give them a much clearer picture of hacking attacks, Coviello claimed.

“Customers are caught in a Catch-22. They’re afraid to deploy technology for fear of violating workers’ privacy” even though security intelligence tools are ultimately the best way to protect personal information, Coviello argued.

The security leader’s remarks follow on from criticism at the same show last year that privacy concerns were hampering intelligence-sharing efforts. The combined pitch caused one French wag to note that there’s only one letter of difference between the NSA and RSA.

Mindful of such unflattering comparisons, Coviello admitted Big Data systems could be “misused”. He said: “Big Brother, ethics aside, will stifle innovation.”

Anonymising services and technologies that offer anonymity, such the Tor network and VPNs, have been in the news recently because of law enforcement action and intelligence agency leaks. Coviello’s line was a controversial one to peddle to European audiences in the wake of the latest Snowden revelations, which put figures on the extent of NSA’s dragnet spying on the phone calls of French, German and Spanish citizens.

“Many privacy advocates hold the polar opposite view to Coviello, believing anonymity online is a fundamental ingredient for online privacy,” writes security consultant and blogger Dave Whitelegg. . “Art’s perspective also highlights the difference in attitudes towards privacy harboured between the United States and Europe,” added Whitelegg. “The European Union was built on its citizens’ rights, including the right to privacy, a right the EU wishes to see exercised online, whereas the US view tends to be ‘privacy is dead’, believing the right to online privacy has been given up and the privacy fight lost.”

Less controversially, Coviello added that security industry needs to act less like a police headquarters that simply responds to attacks and more like beat cops who know their environment and can recognise and respond to anomalies. Big Data technologies were key moving away from a purely reactive security model to an intelligence-driven approach.

“When we understand the context of people’s ‘normal’ behaviour or how information flows on our networks, we can more clearly and quickly spot even a faint signal of any impending attack or intrusion, ” Coviello explained, “This is what makes intelligence-driven security future-proof. It eliminates the need for prior knowledge of the attacker or their methods.” ®

Supercharge your infrastructure

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/29/coviello_keynote_rsa/

New ‘Whistleblower’ Portal Lets User Report Incidents Anonymously

A new Web-based portal could offer employees and other users an anonymous method of reporting complaints or security violations in their enterprises without fear of reprisal.

LockPath, a maker of governance, risk, and compliance (GRC) technology, on Monday rolled out the Anonymous Incident Portal, a cloud-based service that lets users submit complaints, violations, or other concerns without giving away their identities.

The new portal was unveiled in conjunction with LockPath’s release of Keylight 3.5, LockPath’s new hybrid cloud GRC offering, which helps companies automate the security and compliance assessment of suppliers and business partners.

“The Anonymous Incident Portal is a way for employees to let someone know if they see something,” says Chris Caldwell, CEO of LockPath. “It could be a physical security violation, or an IT security violation, a violation of a financial process, or any number of incidents. The key is that there is a secure and anonymous way to do it.”

Some companies have anonymous “whistleblower hotlines,” and the state of New York is considering a law that would help reward and protect whistleblowers, Caldwell observes.

While organizations may not be happy to have employees blow the whistle on potential violations, having them submit their complaints on a secure portal is better than having them dump information to WikiLeaks or give documents to the media, as Edward Snowden did to the NSA, LockPath states. The AIP also gives employees a way to flag incidents to their companies before reporting them to the Securities Exchange Commission (SEC) or other regulatory and law enforcement organizations.

“Employees often struggle with deciding when to report an incident and when to remain quiet given potential repercussions like harassment by the business, a career-limiting move, or termination,” adds Caldwell. “AIP eliminates this fear by providing an anonymous and secure portal to express concerns, which can ultimately create an improved working environment for employees and ensure that a company’s reputation is in its own hands, rather than in the hands of someone else.”

LockPath’s new Keylight 3.5 offering also includes Vendor Manager Hybrid, a new capability that allows third parties to submit audit-related questionnaires through a Web-based portal, bypassing the assessing organization’s corporate network.

The new offering is designed to help companies ensure compliance among vendors and business partners, as well as internally, Caldwell says.

“LockPath has always helped customers manage relationships with third parties to ensure compliance,” Caldwell states. “From law firms to financial institutions to health-care providers, organizations must regularly work with other vendors to complete due diligence in order to meet industry standards and regulations. This new offering lets organizations keep control of their sensitive data within the enterprise, while maintaining effective interactions with outside entities.”

Have a comment on this story? Please click “Add a Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/management/new-whistleblower-portal-lets-user-repor/240163233

Microsoft Software, Overall Operating System Vulnerability Disclosures Rise

As the clock winds down to the sun-setting of support of Microsoft’s 12-year-old XP operating system on April 8 of next year, Microsoft today released new data that demonstrates the dangers of sticking with the older OS, which accounts for about one-fifth of all operating systems in use today.

Case in point: while 17 percent of Windows machines worldwide running the latest versions of software and real-time security tools from Microsoft faced malware in the first half of this year, XP machines got exploited the most. Windows 8 and Windows XP actually encountered nearly the same volume of malware, but XP machines were six times more likely to get infected from those malware threats, according to new data in Microsoft’s Security Intelligence Report Volume 15, which was published today. And XP is still prevalent out there, accounting for 21 percent of all OSes in use today, according to data from StatCounter, Microsoft said.

Meanwhile, the number of all operating system vulnerability disclosures increased for the first time in a while, by nearly 40 percent in the first half of 2013, surpassing the number of browser vuln disclosures, the report says. Some 22.2 percent of all vulnerability disclosures were in operating systems. Browser bug disclosures dropped by 18.3 percent during the period, accounting for some 14.3 percent of all vuln disclosures.

Microsoft also revealed that disclosures of bugs in its own products increased 7.4 percent after a period of decline. There was a 3.1 increase in those disclosures over the same period in 2012.

Industry-wide bug disclosures dropped 1.3 percent in the first half of this year from the second half of 2012, and dropped 10.1 percent since the first half of 2012.

“An increase in application vulnerability disclosures in 1H12 interrupted a trend of consistent period-over-period decreases dating back to 2H09. It remains to be seen whether the decrease in 2H12 marks a return to this trend,” Microsoft said in its report, which gathers data from more than one billion Windows machines around the globe as well as from other vulnerability reports. “Overall, however, vulnerability disclosures remain significantly lower than they were prior to 2009, when totals of 3,500 disclosures or more per half-year period were not uncommon.”

But the big message in Microsoft’s new SIR report is the risk associated with sticking with XP. “It’s still at 21 percent and it’s a 12-year-old OS, which is crazy,” says Holly Stewart, senior program manager at Microsoft’s Malware Protection Center. “A lot of them [XP users] feel XP provides them with everything they want and they are comfortable with it. It’s not about functionality. It’s about increased susceptibility” to threats with XP, she says.

Fiberlink, which manages laptops and desktops for enterprises, recently found that nearly half of the machines it manages for companies are still running XP. Chuck Brown, director of product management at Fiberlink, says he thinks the holdouts are doing so for financial reasons. He’s already seeing machines getting updated to Windows 7 or 8, but fully expects at least 3 percent of his customers to still be XP as of the April 8 deadline.

[New data shows nearly half of XP machines still alive and well among 1 million machines managed by one vendor. See Windows XP Holdouts Hold On.]

XP is being targeted most by three major malware families today, Microsoft says: Sality, which steals personal information and can dial down the security settings in an infected machine; Ramnit, which infects Windows executable files, Microsoft Office files, and HTML files; and Vobfus, a worm that can download other malware onto a PC and can be spread via USB flash drives, for example.

“These are all worms, and fast-spreading ones,” Stewart says. “They incorporate exploits from old vulnerabilities and they rely on the interconnected world … They exploit victims and use that computer as a launching pad to outreach others with the same loopholes — friends, family, etc.”

In the past year, 30 Microsoft Security Bulletins included patches for Windows 7, 8 and XP. “Imagine if XP had not been supported over the last year,” Stewart says.

Microsoft won’t completely cut off businesses who still plan to run XP on April 8, however. The software giant will offer a premiere support contract that will provide critical updates to XP. But the service must be purchased, and it only covers new threats to XP, Stewart says.

The main conduit for threats detected against Microsoft’s own network in the first half of 2013 were Web browsers, the report says. Microsoft IT systems detected some 369,000 malicious JavaScript infection attempts on corporate machines, and some 220,000 malicious URL infection attempts. “Because web browsing was the most frequently used transmission vector for infection attempts at Microsoft in 1H13 … the prevalence of HTML (.htm) and JavaScript (.js) files among threat detections is unsurprising,” the report says. “Malicious program files (.exe) and malware disguised as temporary files (.tmp, .temp) were also detected relatively frequently.”

Other findings in the report: high-severity vulnerability disclosures jumped nearly 13 percent across the industry in the first half of the year after decreasing in the second half of last year. High-severity vulnerabilities comprised 36.7 percent of total disclosures in the first half of 2013.

The full Microsoft SIRv15 report is available here for download.

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/vulnerability/microsoft-software-overall-operating-sys/240163258

Apple introduces “cloudless dictation”, no longer demands your contact list to understand you

Not everyone was happy about Apple’s terms and conditions when it introduced dictation to OS X 10.8 (Mountain Lion).

Speech-to-text was done in the cloud, so Apple got to listen to what you were saying.

In fact, Cupertino didn’t just processs your data off-site.

It collected a bunch of other information about you and your contacts, and hung onto this data and your recorded utterances for an unknown amount of time:

When you use the keyboard dictation feature on your computer, the things you dictate will be recorded and sent to Apple to convert what you say into text and your computer will also send Apple other information, such as your name and nickname; and the names, nicknames, and relationship with you (for example, “my dad”) of your address book contacts (collectively, your “User Data”). All of this data is used to help the dictation feature understand you better and recognize what you say. It is not linked to other data that Apple may have from your use of other Apple services.

At the time of Mountain Lion’s release, we acknowledged why this might be useful.

We wrote at the time that “names are notoriously difficult to recognise and spell correctly, since they frequently don’t come from the same linguistic and orthographic history as the language of which they’ve become part. The Australian mainland’s highest point, Mount Kosciuszko, is a lofty example.”

But we also wondered why it was compulsory.

After all, giving Apple’s Dictation app access to the names of my friends wouldn’t help a jot with dictating this article, for example, nor would it help with any of a huge range of other tasks for which I regularly use my computer.

There were also other problems with a pure-play cloud approach, notably due to latency.

No matter how much beefier Apple’s server farms might be, even than your quad-core Macbook Pro, you have to add the round-trip cost of uploading your digitised voice and fetching back the results.

So the cloud-style dictation just didn’t work like the movies, where words pop up, well, word-by-word as you talk.

Instead, dictation was bursty, and limited to 30 seconds of speech at a time. (That’s only about 70 words, assuming you talk really quickly – and intelligibility drops off with speed.)

Recently, of course, yet another reason for not doing your dictation via the cloud has emerged: the perceived extent of governmental snooping of your on-line activity and the data you generate while you do it.

So here’s some good news if you have updated to OS X Mavericks: offline dictation.

As you can see, the verbiage we quoted above above now reads like this:

When you use Dictation, you can choose to have either your Mac or Apple’s servers perform the speech recognition for you. If you use Mac-based Dictation, your computer will convert what you say into text without sending your dictated speech to Apple. If you use server-based Dictation, the things you dictate will be recorded and sent to Apple…

Additionally, it seems that whenever you switch from server-side voice processing to local dictation, Apple throws away anything its dictation engines may been keeping about you, which is handy to know.

It looks as though this change, introduced in Mavericks, has nothing to do with Edward Snowden and PRISM, and everything to do with quality and usability, since it’s called Enhanced Dictation.

This comes at the cost of a whopper up-front download – 381MB for English (Australia) – that doesn’t seem to have a cancel option if you start it and then change your mind about the bandwidth.

But the new option is not only more private, it also removes the burstiness of cloud-based dictation, giving you “offline use and continuous dictation with live feedback,” which is probably what you expect of a 21st century dictation solution.

And there you have it: there ARE some things that work better without the cloud!

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/TXs1a2_xoZY/