by Michael Smith (Veshengro)
Many readers may wonder why I have begun “attacking” ASUS, and they could be forgiven to think that considering my, what some might consider, negative articles recently. The truth is though that often criticism of this nature is the only was to have policies be looked at again and – maybe just maybe – changed.
Dropping Linux from the Eee PC (and general ASUS products) is a bad idea. The Li9nux operating system is what makes and made the Eee PC what it is/was. Windows is no answer here at all, regardless of what some at ASUS seem to believe.
The only real choice as operating system goes for a Netbook is Linux and while there are sometimes things that do not work straight away out of the box, so to speak, with Linux because of driver codes not having been shared with the developers, such as those for some stuff, such as, for instance, mobile Internet dongles, on the Eee PC with ASUS' own version of Linux everything does and did.
I have an Eee PC 900 (which I love) and ever works well and did so straight out of the box (bar the card reader but then I do not really care on that front as I do not, really, use such SD cards, for instance) and that includes the wireless LAN Internet connection.
ASUS claims that the reason for abandoning Linux is that people asked for Windows on the Netbooks instead of Linux, and that being the reason for the “move”.
However, the better system for Netbooks – and not just for Netbooks – is Linux and that should have been the sales pitch in marketing the Eee PCs at least with Linux. It was, however, marketing that let down ASUS and the Eee PC.
It is true that people who have used Windows are “afraid”, for lack of a better word, often to use an alternative operating system (OS) even if that is a free one, and one that is superior, especially as far as Netbooks are concerned.
Linux boots fast and is stable in most environments; more than can be said for any version of Windows. But I do not mean to be Windows bashing.
The Netbook and Linux go hand-in-glove and are the ideal partners and ASUS had the right idea to start with and a winning combination. ASUS may, however, come to regret abandoning Linux in Netbooks, at least, if not more.
The latest Eee PC Netbooks are becoming small Notebooks/Laptops with 160BG hard disc drives (HDDs) rather than Solid state drives (SSDs). And while apparently still claiming great battery life it would all be better still with the previous concept, that is to say, Linux. If something is not broken then, please, people don't go and fix it – just market it better.
The right marketing has not been done, however, and still is not being done. Instead Linux is being abandoned.
How much, I wonder, is Microsoft paying to oust Linux is something that I would like to know, and may other people, I am sure, too. Or for how little does Microsoft sell the OEM licenses in order to get Windows onto everything.
Dell, on the other hand, still sells Laptops and Netbooks with Linux Ubuntu installed though in on one website of their they had marked Ubuntu down as “Microsoft Operating System – Linux Ubuntu”.
As there is absolutely nothing wrong with Linux on the desktop, whether on PCs, Laptop or Netbook, and Ubuntu, for example, is very intuitive and easy to use, the problem must lie (1) with marketing (but no reseller rewards in it, I guess) of Linux and (2) with the pressure that is put on manufacturers from the side of Microsoft.
I leave the reader to make up his or her mind here.
© 2009
<>
ASUS Eee PCs and Linux
Information Commisioner's Office action against insurance firm
ICO action against insurance firm reminds us that encryption is now needed for all private data, says CREDANT Technologies.
July 2009 (Eskenzi PR) - Reports that the Information Commissioner's Office (ICO) has taken action against a Kent-based insurance company for failing to protect data on around 2,100 of its policy-holders reminds the industry of the need to encrypt private data, whether at rest or on the move, says CREDANT Technologies.
According to Andrew Kahl, the endpoint data protection specialists Senior Vice President of Operations & Co-founder, the insurance firm, part of Lloyds, lost an unencrypted disk holding the data, and has been instructed by the ICO to sign a `formal undertaking' to enhance its data protection methods.
"The firm blamed the data breach - which involved data going back as far as ten years - on a lack of staff training and poor data handling procedures, but the reality is that all firms need to adhere to IT security policies involving encryption of staff and customer's personal data," he said.
"In addition, companies also need to enforce those encryption security policies using suitable IT systems. These systems act as an audit safeguard and can save companies money and embarrassment in the longer term," he added.
Kahl went on to agree that the ICO's comments that the case is a reminder that the appropriate safeguards should be in place to protect personal information is very timely.
We are now 20 months on since the Inland Revenue famously lost a CD- ROM containing the details of around 15,000 pension holders in the post between its Tyneside operation and an Edinburgh office, he explained.
Since that time, countless reports of data breaches and thefts have hit the headlines, again and again.
"The bottom line to all of this is that companies need to take care when handling private data. Data needs to be encrypted and the good news is that the technology required to do this need not cost the earth," he said.
For more on the ICO's action against the Kent-based insurance company: http://preview.tinyurl.com/kwptl2
For more on CREDANT Technologies: http://www.credant.com
<>
Finjan Blocks New Zero-Day Attack on Microsoft Video ActiveX Control
Farnborough, United Kingdom – July 2009 (Eskenzi PR) - Cybercriminals are targeting yet another vulnerability in Microsoft product - the Microsoft Video ActiveX Control. The zero-day vulnerability that was found can be exploited via a malformed Web page.
The attack, that was already spotted in the wild, enables remote code execution (RCE) on the targeted machine. By exploiting this vulnerability cybercriminals are inserting a data-stealing Trojan to the victim’s machine.
For more information about this zero-day attack and a snapshot of the actual code visit Finjan’s blog at: http://www.finjan.com/MCRCblog.aspx?EntryId=2300
Microsoft has just released an Advisory about this vulnerability: http://www.microsoft.com/technet/security/advisory/972890.mspx
Microsoft is currently working to develop a security update for Windows to address this vulnerability.
Web security products utilizing real-time code analysis technologies are the preferred solution to block such 0-day attacks. Yuval Ben-Itzhak, Finjan CTO explains, “Finjan customers are protected from this zero-day attack as Finjan’s Vital Security Web Gateway is able to detect the exploit and block the attack without prior knowledge of the specific technique.”
Finjan’s MCRC specializes in the detection, analysis and research of web threats, including Crimeware, Web 2.0 attacks, Trojans and other forms of malware. Our goal is to be steps ahead of hackers and cybercriminals, who are attempting to exploit flaws in computer platforms and applications for their profit. In order to protect our customers from the next Crimeware wave and emerging malware and attack vectors, Finjan MCRC is a driving force behind the development of Finjan's next generation of security technologies used in our unified Secure Web Gateway solutions. For more information please also visit our info center and blog.
Secure Gateway provides organizations with a unified web security solution combining productivity, liability and bandwidth control via URL categorization, content caching and applications control technologies. Crimeware, malware and data leakage are proactively prevented via patented active real-time content inspection technologies and optional anti-virus modules. Powerful central management enables intuitive task-based policy management, excellent drill-down reporting capabilities and easy directory integration for all network implementation options. By integrating several security engines in a single dedicated appliance, Finjan’s comprehensive and integrated web security solution enables quick deployment, simplified management and reduction of costs. Business benefits include real-time web security (no patches or updates needed), lower total cost of ownership (TCO), cost savings in administration efforts, lower maintenance costs, and reduction in loss of productivity. Finjan's security solutions have received industry awards and recognition from leading analyst houses and publications, including Gartner, IDC, Butler Group, SC Magazine, eWEEK, CRN, ITPro, PCPro, ITWeek, Network Computing, and Information Security. With Finjan’s award-winning and widely used solutions, businesses can focus on implementing web strategies to realize their full organizational and commercial potential. For more information about Finjan, please visit: www.finjan.com.
<>
Britney Spears hack highlights reputational risk of weak Web 2.0-based service passwords
Burlington, MA & Redwood Shores, CA, July 2009 (Eskenzi PR) – The apparent hacking of Britney Spears' Twitter picture service account - with consequent false reports of her death - is a reflection of the increasingly mischievous nature of a small, young – and probably immature - section of the Web user base, says Imperva, the IT compliance and business risk mitigation specialist.
Mildly alarming as reports of Britney's premature demise were, they also came in the wake of incorrect Web reports from New Zealand of the actor Jeff Goldblum also having passed away," said Rob Rachwald, Imperva's director of marketing.
"What the complex online events leading up to the incorrect reports of the celebrity deaths spreading around the Web show us, however, is the sheer power of the Internet in terms of potential reputational damage," he added.
According to Rachwald, since Twitter's picture service currently only has a four-digit numeric password system, a brute force attack would be able to hack into the account in a matter of hours.
And, he says, as new Web 2.0 services evolve on the Net, the effort and focus of the application owners is going to be devoted to the fast availability of new features and commercial models.
As a result, he explained, the new services' IT security protection is likely to get left behind and will almost certainly not be integrated into the application.
For this reason, he went on to say, as well as being careful when it comes to setting secure passwords on these next-generation services, companies need to implement Web application firewalls alongside the services so as to afford better overall protection.
"The key issue here is that companies need to install additional security technology at the same time as when they deploy these new Web 2.0-based services in their organisation," he said.
"This is because Web application firewalls and other protective Internet security systems are becoming more and more important, as they can compensate for internal security control issues," he added.
For more on incorrect reports of Britney Spears' demise: http://preview.tinyurl.com/kn5m6a
Imperva, the Data Security leader, enables a complete security lifecycle for business databases and the applications that use them. Over 4,500 of the world’s leading enterprises, government organizations, and managed service providers rely on Imperva to prevent sensitive data theft, protect against data breaches, secure applications, and ensure data confidentiality. The award-winning Imperva SecureSphere is the only solution that delivers full activity monitoring from the database to the accountable application user and is recognized for its overall ease of management and deployment. For more information, visit www.imperva.com.
<>
SecureFlash by Insight Promotions – Product Review
Review by Michael Smith (Veshengro)
This is one of the cheapest encrypted drives that I have reviewed so far. It is manufactured in the Far East, that is to say, China, but what is not those days.
The setup of the drive was extremely simple and only took a few minuted. Changing the password from the master, which in this case is “password” to a new one is very simple and easy too.
The encryption engine is by encryptX® and work extremely well, though, as the great majority of those devices, with MS Window only. We still need working devices of this kind on Linux.
While it is indeed true that Ironkey® now comes with Linux support, including Ubuntu from version Haughty Heron upwards, the great majority of encryption engines do not, as yet, work out of the box with Linux.
Unlike most, if not indeed all, hardware encrypted USB, and other drives, the files are hidden until the drive is opened by the encryption engine, here they can be seen – even the description of them – but they cannot be opened without the password, however.
encryptX®, a BeCompliant Company, provides encryption and compliance solutions that protect data, devices, and email communications. Over 100 large corporations, thousands of small/medium businesses, numerous government agencies, and 20 million consumers worldwide use encryptX products to secure their devices, data and email.
Could this stick be hacked. Probably, but then again there is no 100% security. Total and absolute security is an illusion, though many fall prey to that idea that it is a fact.
For the little price tag that this drive has got – just a little above a normal unencrypted drive – this is a good option for those that want some high enough degree of security and encryption for their removable discs without, necessarily, wanting to fork out for the likes of Cruzer Enterprise from Sandisc or Blockmaster Safestick (both in the 30 GBP range with the 1GB drives) or higher, such as Ironkey.
The devices at the higher price range do offer additional stuff such as device control, etc., that you do not get with this encrypted drive but then again you get what you pay for in many cases and here you get a basic 256 AES hardware encrypted UBS drive which, from the make, I assume to be a MLC device, for a good price.
One other thing that is different from all other AES 256 hardware encrypted drives that I have handles so far – aside from the Kingston Data Traveler VAULT where the vault is launched as and when – the SecureFlash drive from Insight Promotions does not launch and mount two drives. There is just one. How that is achieved I do not know but, I must say I like it.
To recap, the device is easy to use, sets up very fast and simple, launches quickly and, while the files are visible, encrypts those on the fly. Great secure drive for the price conscious. Maybe we could sell the British government a few thousand of them.
© 2009
<>
Tufin delivers first-to-market functionality with new automatic policy Generator (APG), Dramatically Simplifying firewall policy creation and optimiza
Innovative, Patent-Pending Add-on to SecureTrack Significantly Expands the Scope of its Award-Winning Automated Policy Management Solution
London, June 2009 (Eskenzi PR) - Tufin Technologies, the leading provider of Security Lifecycle Management solutions today announced the immediate availability of the Tufin Automatic Policy Generator (APG), an innovative extension of its SecureTrack firewall operations product. By extending SecureTrack to provide automatic policy generation, Tufin enables security operations teams to “bake security in” to network security operations, and in doing so, reduce a significant cause of operational and audit complexity at its source. Native to SecureTrack, the APG is also part of the new version of the Tufin Security Suite (TSS) version 5.0.
“Automating the creation of optimized firewall rule bases is critical to establishing an accurate baseline for increasing network security and reducing operational costs,” said Eric Ogren, principal analyst of the Ogren Group. “Well defined firewall rules lower the risk of creating holes in network security, eliminate many of the business disruption issues that can accompany firewall deployments, and reduce the number of costly support calls. Automation ensures that firewall rule bases act on the intelligence discovered from actual observed business traffic.”
Automatic Policy Generation: Expanding end-to-end Security Lifecycle Management
The Tufin Automatic Policy Generator (APG), a breakthrough SecureTrack feature, enables administrators to automatically generate a firewall rule base through analysis of firewall log usage. Powered by Tufin’s patent-pending Permissive Rule Analysis technology, SecureTrack’s APG “watches” firewall traffic for a set period of time, and then automatically generates a refined, accurate and specific rule base optimized to permit business critical traffic.
The infamous 'Any' objects in the firewall rule base, signifying any potential traffic in the source, destination or service, are replaced with actual network addresses and services, eliminating overly permissive rules that increase the risk of for unauthorized or curious users gaining unauthorized network access. The APG can be utilized with all network firewall vendors.
The APG can be used to easily integrate a firewall into a non-firewalled network segment with minimal business disruption. By eliminating the business continuity issues that often come with new firewall deployments, operations teams can secure open network segments in a non-invasive way and retain continuous availability for network services. The ability to painlessly firewall internal network segments also reduces the need to implement potentially questionable or weak compensating controls that might be used for relevant PCI or other compliance requirements.
“It’s said that an ounce of prevention is worth a pound of cure, and we have taken that to heart with the APG Add-on,” said Shaul Efraim, VP Products, Marketing and Business Development, Tufin Technologies.” With the APG, we have introduced automation at a very important and operationally critical juncture – the beginning of the lifecycle - delivering on our vision for end-to end-policy management. We’re grateful for the strong customer and channel relationships we have established – it’s their feedback that has enabled us to deliver functionality that continues to raise the bar for our class of solutions.”
Tufin has published a white paper on the Automatic Policy Generator, which is available for download at www.tufin.com/APG.
Tufin SecureTrack™ is the market-leading Security Lifecycle Management solution. SecureTrack enables organizations to enhance security, reduce service interruptions and automate day-to-day tasks through powerful firewall management capabilities and reporting. SecureTrack helps security operations teams to control and manage policy changes, analyze risks, and ensure business continuity and allows managers to easily understand the big picture and align operations with corporate and government security standards.
Tufin Technologies is the leading provider of Security Lifecycle Management solutions that enable large organizations to enhance security, ensure business continuity and increase operational efficiency. Tufin's products SecureTrack™, SecureChange™ Workflow, and the Tufin Security Suite™, help security operations teams to manage change, minimize risks and dramatically reduce manual, repetitive tasks through automation. Tufin’s open, extensible architecture enables any company with best of breed applications, devices and systems to take advantage of Tufin’s unmatched policy optimization, change management, and auditing capabilities. With a combination of accuracy and simplicity, Tufin empowers security officers to perform reliable audits and demonstrate compliance with corporate and government standards. Founded in 2005 by leading firewall and business systems experts, Tufin now serves more than 325 customers around the world, including leading financial institutions, telecom service providers, transportation, energy and pharmaceutical companies. For more information visit www.tufin.com, or follow Tufin on: Twitter at http://twitter.com/TufinTech,
LinkedIn at http://www.linkedin.com/groupRegistration?gid=1968264,
FaceBook at http://www.facebook.com/home.php#/group.php?gid=84473097725
The Tufin Blog at http://tufintech.wordpress.com/
<>
Tufin Technologies Delivers on the vision of Security Lifecycle Management with Tufin Security Suite (TSS) 5.0
TSS’ distributed deployment architecture, new workflow GUI and Tufin Open Platform API’s provide organisations with an automated, flexible, and highly robust platform to create, monitor, manage and audit network security policies
London, June 2009 (Eskenzi PR) - Tufin Technologies, the leading provider of Security Lifecycle Management solutions today announced a new release of its Tufin Security Suite (TSS). Version 5.0 elevates TSS from an integrated offering of Tufin’s award-winning SecureTrack and SecureChange Workflow product set to a robust, flexible and fully automated security and network policy management platform.
The significant innovations to the TSS architecture and workflow interface, combined with new functionality provided by the Automatic Policy Generator (announced today in a separate release), has provided Tufin with the foundation to deliver on its vision of Security Lifecycle Management: A cohesive framework for centralized network security policy management.
“Simplicity is the best antidote for complexity, which in the world of security operations, takes the form of automation and ease of use,” said Richard Stiennon, chief analyst of IT-Harvest.” What makes delivering that automation easier said than done is two things: the need to introduce it into the environment without creating new management complexity, and to be able to adjust it as needed based on business or regulatory requirements. Tufin has been consistent in delivering solutions that tackle these industry challenges head on, and this release is a huge step forward in extending its success beyond firewall operations.”
TSS 5.0 – End-to-end Security Lifecycle Management
- TSS 5.0 enables administrators to accomplish more, with additional security and in less time. As the company and market continues to evolve, the architecture, usability, and functional innovations introduced in TSS 5.0 provide the foundation required for Tufin to extend its award-winning automation and management to any network device. These innovations include:
- Automatic Policy Generation – True to its name, Tufin’s Automatic Policy Generator (APG) automates the creation of optimized rule bases for new and existing firewall deployments. This not only eliminates the risk introduced by overly permissive policies without impacting business continuity, it reduces future complexity that comes over time by ensuring the initial rule base is optimized from day one.
- Distributed Deployment Architecture - For organizations spread across multiple data centers or a single large data center, TSS now supports a distributed deployment architecture, meaning that multiple TSS appliances can be centrally managed from a single console. By providing a flexible, distributed deployment architecture, Tufin Security Suite installations can scale to support any size organization while reducing the total cost of ownership and maintaining ease of deployment of its award-winning solutions.
- New Workflow Interface – Tufin’s workflow engine is the core of its SecureChange Workflow product, a change management solution designed specifically for security and network policy change requests. Using Tufin’s re-engineered, user-friendly workflow GUI, organizations can easily and intuitively design an unlimited number of fully customizable policy changes with tight integration with directory services (such as Microsoft Active Directory) and proactively manage incoming change tickets with risk analysis, business continuity and compliance information.
- Tufin Open Platform (TOP) – TOP is both an industry-wide alliance of leading security and networking vendors and the management framework for delivering open, multi-vendor Security Lifecycle Management. Purpose-built to enable streamlined, policy-driven network and security management, Tufin’s open architecture supports and expedites third party interoperability with TSS and helps joint customers to be better equipped to manage day-to-day operations of today's complex, intertwined, dynamic networks. TOP was formally launched last month with support for Check Point, Cisco, Juniper, Fortinet, F5 and Blue Coat.
More alliance partners will be announced over the coming months.
“The launch of TSS 5.0 heralds a huge step forward in delivering on our vision of security lifecycle management by extending our ability to automate policy management for any device in an organizations network security eco-system”, said Ruvi Kitov, CEO, Tufin Technologies. “We have been able to execute on such a broad vision in a short period of time by maintaining a tight, laser-like focus on our fundamental mission -- to make security administrators’ lives easier while reducing operational costs. At the end of the day, that’s what drives both our roadmap and our decision making process.”
Pricing and Availability
TSS 5.0 will be Generally Available in August 2009. Pricing starts at $20,000.
Tufin Security Suite ™ (TSS) is industry’s first comprehensive Security Lifecycle Management solution. Seamlessly integrating its award-winning SecureTrack and SecureChange Workflow solutions into an open, extensible and distributed architecture, TSS features full interoperability with Check Point, Cisco, Juniper, Fortinet, F5 and Blue Coat. TSS provides the capacity to automate security policy management for any device in the Security Lifecycle Management eco-system, enabling organizations to reduce the cost of security operations and compliance while increasing operational efficiency, tightening network security, and ensuring business continuity.
Tufin SecureTrack™ is the market-leading Security Lifecycle Management solution. SecureTrack enables organizations to enhance security, reduce service interruptions and automate day-to-day tasks through powerful firewall management capabilities and reporting. SecureTrack helps security operations teams to control and manage policy changes, analyze risks, and ensure business continuity and allows managers to easily understand the big picture and align operations with corporate and government security standards.
Tufin Technologies is the leading provider of Security Lifecycle Management solutions that enable large organizations to enhance security, ensure business continuity and increase operational efficiency. Tufin's products SecureTrack™, SecureChange™ Workflow, and the Tufin Security Suite™, help security operations teams to manage change, minimize risks and dramatically reduce manual, repetitive tasks through automation. Tufin’s open, extensible architecture enables any company with best of breed applications, devices and systems to take advantage of Tufin’s unmatched policy optimization, change management, and auditing capabilities. With a combination of accuracy and simplicity, Tufin empowers security officers to perform reliable audits and demonstrate compliance with corporate and government standards. Founded in 2005 by leading firewall and business systems experts, Tufin now serves more than 325 customers around the world, including leading financial institutions, telecom service providers, transportation, energy and pharmaceutical companies. For more information visit www.tufin.com, or follow Tufin on: Twitter at http://twitter.com/TufinTech,
LinkedIn at http://www.linkedin.com/groupRegistration?gid=1968264,
FaceBook at http://www.facebook.com/home.php#/group.php?gid=84473097725
The Tufin Blog at http://tufintech.wordpress.com/
<>
Seed Newsvine