Information Age Autumn Forum 2009
The InformationAge Enterprise Security & Continuity event takes place tomorrow in London as part of their Autumn Forum 2009. I’m giving the opening keynote on “Securing the enterprise in the cloud”. The rest of the day has a great lineup, with some real-world experiences as well as looking at future technologies.
One of the toughest parts of ‘the cloud’ is understanding what people mean by ‘the cloud’. Without that understanding, it is very difficult to figure out what sort of security measures you need. For example if you are looking at an application as a cloud service (aka SaaS) then understanding what security is available is very different from looking at infrastructure services in the cloud. My talk starts with a look at where the Jericho Forum cloud layer / cloud cube models can help clarify exactly what people are talking about before looking at the security issues which need to be addressed.
See you there.
Guy Bunker
Dealing With A Data Breach…
An old friend and frequent co-presenter, Stewart Room from Field Fisher Waterhouse has launched a new service to help companies deal with data breaches. BreachAction takes an innovative approach to solving the problems of security incidents. While my book “Data Leaks For Dummies” looks at it from a practical standpoint on how you bring people, processes and technologies together to prevent data leaks, Stewart brings the legal side of things to the table – helping you to understand and deal with the legal consequences. If you want to get ahead of the game, then they also offer a Incident Readiness Workshop as well.
Data leaks have become an all too regular occurance and technology was seen as being ‘the solution’, the reality is that when something does happen, the lawyers get involved – and it is usually well out of the comfort zone of most corporate legal departments. Having a tech-savvy legal expert like Stewart to tell you what you can and can’t do to minimize the consequences is very useful.
Guy Bunker
RSA Europe 2009
RSA Europe starts today in London and looks like it will be a great programme. My session is on cloud computing and security and has had a lot of interest. There is even a preview podcast to be found here.
RSA attracts an interesting mix of contributors, with sessions that are just for propellor-heads to those which are more accessible to business people. Security remains a hot topic no matter which industry you are in and whereabouts you are in an organisation so getting the opportunity to listen to, and talk with, people with experience is an opportunity not to be missed.
See you there.
Guy Bunker
Small businesses need to prepare for possible postal strikes
With the UK braced for a winter of possible postal strikes, we are urging small businesses considering paying bills online for the first time to stay safe and be aware of the potential dangers. Taking advantage of online banking is the obvious way to avoid being hit by late payment surcharges caused by cheques caught in the postal strikes. Yet for those more used to traditional bill payment methods, the world of online banking may seem daunting and full of potential pitfalls.
We recommend the following tips to ensure SMBs are confident they are browsing the web safely and that the postal strike poses no problems for those looking to make their regular payments with no interruptions:
Bank safely
If you use online banking, never do so on a public or shared computer or on a wireless network lacking security features such as a firewall. You might risk a hacker capturing your account and login information and stealing your money. Always type the Web address of your bank into the Web browser, never click a link from an email.
Online bill payment
Begin any online payment session by making sure your security software is turned on, and is updated.
Use only known and reputable sites, as using an unknown web site can be risky. One way to increase safety is to make sure any page where you enter data such as your address or credit card number uses encryption. You can tell if it uses encryption by the Web address, which will start with “https.” Another thing to look for is the padlock icon at the bottom of the browser frame, which is intended to indicate that the Web site you are visiting uses encryption to protect your communications. Check company credit card statements regularly for unexpected transactions.
Safe Surfing
When paying bills always type the address into the browser rather than following links from email or from search engines. Criminals are now “poisoning” search engine results and leading unsuspecting people to fake sites. You can avoid clicking through to potentially unscrupulous websites by using an online security product with web safety warnings.
Ross Walker, Director Small Business, Symantec
Storage Expo – new trend is Stop Buying Storage!
I’m at the Storage Expo show at Olympia, London.. There is good attendance this year (and it’s not just vendors and analysts!). A couple of observations so far:
First the hardware vendors are getting a pretty tough time of it. The messaging from most people here is around the fact that storage infrastructure desperately needs to be optimised and consolidated.. There seems to be a general theme of “the hardware vendors have been over-selling for years” and that the right thing to do at this point is to step back and re-assess the need to buy more expensive disk.
Secondly, business is getting done here.. Last year was an opportunity for the storage community to look for new job opportunties. This year sees customers researching solutions to their IT infrastructure problems.
I hear that this year is the last for this particular show.. Shame, it’s finally doing what it’s supposed to.
Darren Thomson
StorageExpo: Olympia 14-15 October 2009
Well it’s that time of year again and StorageExpo starts tomorrow at Olympia, London It should be fun – all the usual suspects are there and there will no doubt be some interesting new stuff to look at and hear about.
Scott McNealy gave the opening keynote at Oracle World in San Francisco earlier this week and highlighted the top 10 innovations from Sun. Storage is in the list several times including NFS/PC-NFS & ZFS/OpenStorage. If you were then to include the number of storage management applications built using Java then the list would be endless.
I first used Java more than 13 years ago to build a client for, what was then, OpenVision NetBackup (now Symantec NetBackup). The big benefit was that you could run it on all platforms (ok, so back then there were a few nuances, but the idea was amazing). Subsequently it was used for the front-end for all the VERITAS / Symantec enterprise backup, storage and high-availability products… along with everyone else in the industry. When you go to StorageExpo, take a look around at the applications running on the screens and make a note of how many require Java to work.
See you at Olympia.
Guy Bunker
Small Businesses sloppiness could result in corporate ID fraud
Small businesses are being warned of the dangers posed by irresponsible disposal of sensitive materials. A survey, commissioned by Fellowes launched to coincide with National Identity Fraud Prevention Week highlighted that 79 percent of businesses are risking corporate identity fraud by not destroying sensitive material they throw away or recycle.
And it’s not just hard copy material that is putting small businesses at risk. Data stored on computers and PDA’s can also leave SMBs vulnerable to corporate ID fraud if IT security is not up to scratch. A recent survey from Symantec found one in four SMBs have suffered security breaches, with 13 percent losing money as a result.
People tend to associate ID fraud as a risk to themselves as individuals, but it can impact businesses, and SMBs are most at risk. Negating this risk needn’t be a daunting task, in many cases simple processes like regularly updating security software, firewalls and passwords is enough and doesn’t require deep technical knowledge or dedicated IT staff. However, it’s imperative these organisations understand how to take simple steps to protect themselves and limit any potential harm.
Recommended steps for SMB’s:
- Put in place a security solution that is designed for businesses and will keep your critical information safe wherever it is used or stored (laptops, desktops, mobile devices, servers, in email, over the network, and in storage devices)
- Ensure you have effective and accurate anti-spam protection. There was a 192 percent increase in spam across the internet from 119.6 billion messages in 2007 to 349.6 billion in 2008 and tricksters are getting more creative
- Stay informed: Several companies publish reports that help define the threat landscape for SMBs.
- Have good reliable backup in place, and keep a spare copy in a secure place away from the office.
Abigail Lovell
How Many Passwords…
… Must A Man Write Down? – to paraphrase the great Bob Dylan. There is (yet again) a story of phishing against web based email in order to get passwords. This is not new – what has been picked up on this time (but has always been true) is that people use the same email for their bank as they do for their email and often everything else. So, if one is compromised, then they all are. So how many passwords do you need?
Well, you need to minimize the number – but not down to one. So, I recommend three. You can remember three relatively easily and you shouldn’t have to write them down. One for the bank – and only for the bank, this should be the strongest cryptographically (so some random numbers, letters and other characters). The next one is for things which involve money, so credit cards / on-line shopping sites / email finally one which is used for the rest – for those sites which require you to log on but only so they can track you.
One of the other dangers with email is that once there is access then the cyber-criminal can see who you do business with (including your bank). They can potentially then request a password reset – which would mean all your hard work keeping passwords safe was pointless. Having at least two email accounts can help you keep an eye on those emails which are important (bank, bills etc) and those which are just marketing.
Maintaining your digital information in the Internet Age is hard and requires a certain amount of vigilance. It also needs some common sense as well… so do remember to change your password regularly. Don’t share usernames and passwords with friends or family – and if you are somewhere which is Internet ‘unsafe’, such as a cyber-cafe, don’t log onto those sites which you would be afraid to be compromised. Finally, if anyone ever suggests you email them your username and password – for whatever reason – don’t do it. If you are worried by the contents of the email, make a phone call to clear things up.
Guy Bunker
One Percent Of US PC’s A New Bot?
There is a new piece of malware doing the rounds, a Trojan called Zeus or ZBot (and according to one sourceit has infected 1% of PCs in the US and is now the source of the largest bot network in the world). Most of the larger anti-virus / anti-malware applications, including Symantec & Norton, detect Zeus and its variants – but you do need to keep up to date with the signature files (and therefore your subscription!)
These days, updates happen automatically – as long as you haven’t switched them off. Unfortunately people do switch off the automatic update feature – usually because they want to download something else or watch TV on the PC and they believe that the downloads will effect the speed / picture quality. Well, if you happen to be on a really, really slow line, then there is some truth in that, but for most people, this is no longer an issue – so switch those updates back on!
(And remember… don’t open attachments from people you don’t know – in and look closely at the attachment from those you do – if it looks like an application for example those files with the extension .EXE, or .MSI – then don’t open that either. The easiest way for malware, especially bots to be installed on your system is for you to be tricked into doing it!)
Guy Bunker
-
Subscribe
-
-
UK Orders
US Orders -
UK Orders
US Orders -
Links, downloads and other resources
Symantec UK
Symantec Podcast Directory
Symantec Security Response
