Origin Storage says Canadian health data theft highlights case for multi-layered drive security

Basingstoke, 18^th March 2011 - Reports from Canada about the theft of a hospital hard drive containing photos and videos of patients shows how easy it is for data drives to go missing in public areas, says Origin Storage.

And, says Andy Cordial, the MD of the storage systems specialist, the drive theft incident at Misercordia Hospital in Edmonton, Alberta, shows that - no matter what security policies an organisation has in place surrounding data security - hard-pressed staff will often take the easy option and ignore procedure.

"So what is the solution? Clearly security policies surrounding the security of patient data were in place at this hospital, but they just weren't followed, so the answer  has be to introduce multiple layers of security, which staff simply cannot circumvent, even if they want to," he said.

"Our own DataLocker range of PIN-protected portable hard drives (http://bit.ly/2vb6y9) is a good example of a multi-layered security system. Users can still have the benefit of AES encryption on the drive for security, but as an added measure, users must also know the passphrase of the security unit, without which they cannot access the data," he added.

According to Cordial, had the Edmonton hospital used such a device even if the thief walked off with the drive, the unit would have locked automatically, meaning that access to the data would have been prevented.

Using this approach to data security, says the Origin Storage MD, is an ideal way of bolstering the existing data security defences in an organisation, in situations where existing IT security policies cannot be fully applied.

Origin's observations amongst its many customers, he says, is that data needs protecting whether it is at rest or in transit and, whilst encryption offers an excellent form of protection, adding extra layers of security in portable or back-up situations makes a lot of sense.

"Had this incident happened in the UK, the Information Commissioners Office would have been on to the health body concerned very quickly indeed, and at the very least, publicly secured a written guarantee from managers that a change of security procedures – to prevent a recurrence  - would take place,” he said.

“That means that management heads will roll if an infringement of the Data Protection Act occurred again. This sort of incident - and the consequential publicity plus investigations that result - has a curious habit of significantly grabbing managerial attention," he added.

"Using multi-layered technology can not only avoid a data loss for whatever reason, it can also avoid dragging your organisation's reputation through the mud, as has clearly happened with this hospital."

For more on Origin Storage: www.originstorage.com

For more on Edmonton hospital patient data disk theft: http://bit.ly/fNb5IX

This press release is presented without editing for your information only.

Full Disclosure Statement: The ICT REVIEW received no compensation for any component of this article.

Venafi survey reveals enterprises plagued by epidemic of stolen and lost digital certificates

78% of organisations have experienced downtime due to mismanaged encryption this year

London – March 16, 2011 – Venafi, the inventor of and market leader in Enterprise Key and Certificate Management (EKCM) solutions, today announced the shocking findings of its 2011 Venafi Encryption Key and Digital Certificate Management Report. The report reveals that organisations are deploying increasing numbers of digital certificates and encryption technologies, but that these security assets are also becoming lost, stolen and unaccounted for in epidemic proportions. Ironically, digital certificates and encryption keys are critical components of all information security programs, but they become dangerous liabilities when they go missing and find their way into the wrong hands.

Jeff Hudson, CEO of Vanafi said: “It is well documented that digital certificates played a key role in the Stuxnet attack that destroyed multiple centrifuges in an Iranian nuclear facility, and it is widely accepted that lost encryption keys can provide malicious insiders access to valuable corporate information revealed on high–profile whistle–blower sites such as WikiLeaks. Venafi compiled results from market and analyst report research, from a 471–respondent survey that included managers up to C–level executives from enterprise–class organizations within multiple industries, and from prior market surveys. The findings are shocking.”

Respondents surveyed reported the following:

• 51 percent stated they had experienced either stolen or unaccounted-for digital certificates, or that they were uncertain if their organisations had lost, stolen or unaccounted–for digital certificates in general.
• 54 percent stated they had experienced either stolen or unaccounted for encryption keys, or that they were uncertain if their organisations had lost, stolen or unaccounted for encryption keys in general.

Exacerbating the problem is the volume and diversity of encryption technologies and certificate authorities (CAs) organisations must deal with on a daily basis. The number of encryption assets in their inventories grows regularly, and scattered individuals and teams frequently manage them. According to the survey findings:

• 46 percent of organisations are managing at least 1,000 digital encryption certificates; 20 percent are managing more than 10,000.
• 83 percent of organisations are managing technologies from at least two different CAs; 18 percent are dealing with more than five.
• 88 percent of organisations have multiple administrators managing encryption keys; 22 percent have more than 10.
• 42 percent of organisations manage encryption technologies from at least four vendors; 8 percent are dealing with more than 10.

Fifty–nine percent of the respondents surveyed worked in organisations with more than 5,000 employees. Respondents' organisations spanned a wide range of industries, including high tech, telecommunications, banking/financial services, energy/oil and gas, government, aerospace, manufacturing and retail. Among the respondents was one of the world's largest food distributors and consumer retailers. To access the complete report, visit: www.venafi.com/market-data.

Learn More about Venafi and Customers at Infosecurity 2011

This announcement comes on the heels of the recently announced Venafi Encryption Director 6 product release. Director 6 is recognised by customers and analysts as the only security platform that can fully automate EKCM processes that allow organisations to automate discovery, monitoring, validation, management and security of the most commonly used encryption assets. During Infosecurity 2011, 19^th to the 21^st April 2011 in London, Venafi will be providing on–demand demonstrations of Director 6 in its booth (# AA52) during exhibition hours.

About Venafi

Venafi is the inventor of and market leader in Enterprise Key and Certificate Management (EKCM) solutions. Venafi delivered the first enterprise-class solution to automate the provisioning, discovery, monitoring and management of digital certificates and encryption keys—from the desktop to the datacenter—built specifically for encryption management interoperability across heterogeneous environments.

Venafi products reduce the unquantified and unmanaged risks associated with encryption deployments that result in data breaches, security audit failures and unplanned system outages. Venafi customers include the world's most prestigious Global 2000 organizations in financial services, insurance, high tech, telecommunications, aerospace, healthcare and retail. Venafi is backed by top-tier venture capital funds, including Foundation Capital, Pelion Venture Partners and Origin Partners. For more information, visit www.venafi.com.

There are no zombies in Denver, Colorado says SecurEnvoy

16/3/2011 , London - An amusing incident involving a Denver, Colorado digital road sign that was hacked to display `Zombies Ahead' has been highlighted by SecurEnvoy as a classic demonstration of the need for transparent authentication.

"The Denver incident at the weekend - amusing though it was - centered on the fact that someone opened an unlocked control panel and reprogrammed the warning road sign," said Andrew Kemshall, technical director with SecurEnvoy, the pioneers of tokenless authentication.

"The $64,000 question, once the laughter has died down, is why the highways authority didn't use some form of security, and the answer is that conventional security with its tokens, often just gets in the way of people doing their job," he added.

But, says Kemshall, what if the highway staff were able to authenticate themselves to the road sign - and all manner of emergency highway equipment - using their smartphone?

Let's face it, he adds, almost everyone carries a mobile with them these days, and highway workers in the US are no exception, as they probably use them to communicate with their colleagues and, of course, their base.

But the director of technology with SecurEnvoy went on to say, what if that same mobile could act as an authenticator to many other electronic systems, and not just digital road signs?

It could, for example, allow managers on the highway to enter staff worksheets online, via the regular Internet, but authenticating themselves without the need for passwords and tokens. Just type in your ID to the Web site, and a mobile phone, key in the returned electronic token number, and away you go - securely.

Just as smartphones have revolutionised the security of lone worker employees - a legal requirement in many organisations - so the smartphone can also be used to securely authenticate users without the need for an easily-lost two-factor authentication (2FA) token.

"As we've seen amongst the banks, who are now moving to 2FA devices to enhance online banking security, IDs and passwords are no longer enough to secure online systems - unless you happen to be the memory man and can remember a 12 digit alphanumeric with upper and lower case digits," said Doe.

"This is what makes the Denver, Colorado Zombies road sign incident such a key example of what can happen when security fails because it is too cumbersome and if it’s happened in the US, how long before it happens here. If the workers had been able to use their mobiles to authenticate themselves, this saga wouldn't have occurred," he added.

"This incident may be funny, but it could have been quite nasty if the hacker hadn't been so humorous. All sorts of traffic panic situations could have occurred, and that really is not good."

For more on SecurEnvoy: www.securenvoy.com

For more on Zombie road signs in Denver, Colorado: http://bit.ly/elUaSz

Idappcom blames hacktivists for SpyEye DDoS enhancements

14^th March 2011 - The blame for a DDoS - distributed denial of service - enhancement being added on the infamous SpyEye ebanking malware has been laid at the feet of the WikiLeaks hacktivists by Idappcom.

According to the data traffic analysis and security specialist, it was almost certainly the development - and propagation - of the LOIC DDoS utility by supporters of the Anonymous hacktivist group)

http://bit.ly/aPn34c) that spurred cybercriminals into adding the `feature' to SpyEye.

"What we have been witnessing in the black hat hackersphere these last few months is a mirror image of evolutions in the so-called white hat security arena," said Anthony Haywood, Idappcom's chief technology officer.

"The development of the Low Orbit Ion Cannon DDoS utility showed that it is possible for a few concerted Internet users to stage a powerful DDoS attack on major sites such as MasterCard (http://bit.ly/fP0oJr) and this, in turn, made the cybercriminals behind SpyEye realise its potential and add the `feature' the online banking trojan," he added.

The Idappcom CTO went on to say that, had the Anonymous/WikiLeaks DDoS utility not been developed, then the world - on both sides of the white/black hat hacker divide - would have remained largely ignorant of what a powerful weapon a DDoS utility is.

SpyEye, he explained, is a form-grabbing trojan horse malware that operates in a similar manner to Zeus but has been marketed by cybercriminals as a lower-cost alternative darkware application that heists banking credentials from infected users' PCs.

The irony of the DDoS enhancement to SpyEye, Haywood says, is that it will push the price of SpyEye rentals to cybercriminals, and so increase the revenue stream for the developers of the trojan.

"Idappcom's in-depth research into darkware-driven side of Internet traffic, makes us realise what a breakthrough the DDoS enhancement to SpyEye really is. We already know that the development team behind the Zeus trojan has also been working on SpyEye since last October (http://bit.ly/h4IW6l) so it can only a matter of time before Zeus gets this enhancement as well," he said.

"This development really is bad news for those users of the Internet who access their banking system online, as it breathes new life into SpyEye, and prolongs the agony of online banking cybercrime," he added.

"It's to be hoped that the citizen evangelists realise the immense mistake they made in developing such a powerful cybercrime weapon as the LOIC utility, and that the genie really is now well and truly out of the bottle."

For more on the SpyEye DDoS enhancements: http://bit.ly/gly9nV

For more on Idappcom: www.idappcom.com

ISACA’s EuroCACS Conference Demystifies the Cloud

Event for IT Professionals Will Take Place 20-23 March, Manchester

London, England, (8^th March 2011)—Global business and information technology (IT) leaders will meet at the European Computer Audit, Control and Security (EuroCACS) Conference in Manchester from 20-23 March to share the latest guidance on key IT security and governance issues facing enterprises today. Hosted by ISACA, a global association of 95,000 IT professionals, EuroCACS will examine topics such as virtualisation, outsourcing, governance, risk and compliance, social computing, social networking and human factors, and cloud computing.

EuroCACS will feature 12 sessions that help attendees demystify the cloud.

Urs Fischer, CISA, CRISC, owner of Urs Fischer IT GRC Consultancy, will examine the benefits that cloud computing can offer from the perspective of cutting costs—a key motivation for the migration from in-house services. Mike Small, information security management advisor, will outline the changes to identity and access management that will exist in the cloud environment, and Peter Wood, CEO, First Base Technologies LLP, will share how to improve information security in the cloud.

Robert Stroud, CGEIT, vice president, CA Technologies will be looking into his ‘crystal ball’ to discuss the impact of new technology and emerging trends, including the affect cloud-computing is likely to have on the future of IT.

Prof. John Walker, CISM, managing director of Secure-Bastion Ltd, will address the challenges and risks involved in implementing cloud-based solutions in his session titled ‘Cloud Computing and the Extended Perimeter: New Age Risk Management’. Walker is confident that cloud-based solutions can match, and even exceed, those in place in-house today, within the areas of operational ownership, reducing cost and increasing efficiency.

“Cloud computing provides opportunities of scale, with the ability to switch into and out of services as dictated by operational need,” said Walker. “With the appropriate governance structures in place, cloud computing can add substantial value to an enterprise by allowing for flexibility and potentially reducing costs substantially.” 

To learn more about the emerging opportunities and technologies that are available to drive the business, visit www.isaca.org/eurocacs. For a complimentary white paper titled Cloud Computing: Business Benefits With Security, Governance and Assurance Perspectives, visit www.isaca.org/cloud.

About ISACA

With 95,000 constituents in 160 countries, ISACA^® (www.isaca.org) is a leading global provider of knowledge, certifications, community, advocacy and education on information systems (IS) assurance and security, enterprise governance and management of IT, and IT-related risk and compliance. Founded in 1969, the nonprofit, independent ISACA hosts international conferences, publishes the ISACA^® Journal, and develops international IS auditing and control standards, which help its constituents ensure trust in, and value from, information systems. It also advances and attests IT skills and knowledge through the globally respected Certified Information Systems Auditor^® (CISA^®), Certified Information Security Manager^® (CISM^®), Certified in the Governance of Enterprise IT^® (CGEIT^®) and Certified in Risk and Information Systems Control™ (CRISC™) designations.

ISACA continually updates COBIT^®, which helps IT professionals and enterprise leaders fulfill their IT governance and management responsibilities, particularly in the areas of assurance, security, risk and control, and deliver value to the business.

Follow ISACA on Twitter: http://twitter.com/ISACANews

Metro Bank Provide Innovative Approach to Banking and Security with Trusteer

London, 8th March, 2011 – Metro Bank, the first new high street bank in the UK for 100 years, today announced it has enlisted the Trusteer Rapport secure browsing service to ensure its customers are protected and secure in their online transactions with the bank, from the start. Having experienced exponential growth since its launch in July, a key consideration in Metro Bank’s selection of Trusteer is that it is a proven security technology that can scale in a rapid growth environment moving from protecting a several thousand customers one day to millions the next.

Metro Bank brings a fresh approach to banking in the UK.

As a new entrant to the industry, Metro Bank has the perfect opportunity to benefit from the latest technology and business practice. One such area is online banking where it believes it is important not only to secure customers accessing their bank accounts online, but also when they spend online on other websites, with the mindset that providing adequate protection for all of its customers’ online financial transactions is paramount.

Craig Donaldson, CEO, Metro Bank PLC, explains further, “When we launched in July, we wanted to differentiate our services from other high street banks.  We take the security of our customers very seriously and that means we have the best security components available.  By adding Trusteer to our armory and offering it as a complimentary service to our customers, we can ensure that not only do we provide an  unparalleled customer service experience, but also that our customers’ money is completely safe and secure”.

“By selecting Trusteer, Metro Bank has plugged into the biggest financial attack database on the internet and can immediately leverage the experience of the most attacked brands in the world to protect their customers against malware and phishing attacks,¨ said Mickey Boodaei CEO of Trusteer.  “When it comes to being able to detect, analyze, and remove financial threats from customers' computers trusteer has proven over and over again that it’s the fastest and most comprehensive technology in the market today.”

Security Begins At Home

Unfortunately, in today’s threat environment, traditional protection methods (firewalls and antivirus software) are inadequate as criminals are continually striving to find ways to circumnavigate them. Zeus is one such example with its ability to morph making it hard for traditional technology to detect. Providing additional security measures helps everyone bank safely online, even those who are not technically savvy, which helps keep costs down. The strength of Trusteer is that it protects customers at their own PC providing a trusted secure access point to the bank, meaning they can transact securely and provides confidence that everyone is protected – bank and customers.

Trusteer Secures Online Banking

When a Trusteer user browses to sensitive websites such as internet banking, Webmail, or online payment pages, the service immediately locks down the browser and creates a secure tunnel for safe communication with the web site. This prevents malware from injecting data and stealing information entered and presented in the browser. Trusteer also removes malicious financial malware it discovers on protected machines. The service is directly connected to the bank and to a 24x7 fraud analysis service. Attempts to steal money from customers are immediately detected by the bank and are blocked using various layers of protection.

Trusteer Secures Online Spending 

When a customer uses their bank card to make an online purchase from a computer protected by Trusteer, the Rapport service automatically detects the action and then prevents fraudsters from intercepting the card number and protects any other personal information entered by the user into the webpage.

About Metro Bank PLC

Metro Bank was co-founded by Vernon Hill and Anthony Thomson. It is based on the successful Commerce Bank model that was established by Vernon Hill in the US in 1973. A UK management team worked with Vernon Hill to help bring this model to the UK market.

Metro Bank operates retail hours, not banking hours. It will be open seven days a week (8am- 8pm Monday to Friday, 8am - 6pm Saturday, 11am - 4pm Sunday and bank holidays), every day of the year apart from Good Friday, Easter Sunday, Christmas Day and New Year’s Day.

Metro Bank PLC. Registered in England and Wales. Company number: 6419578. Registered office: One Southampton Row, London, WC1B 5HA. ‘Metrobank’ is the registered trade mark of Metro Bank PLC.

In relation to acceptance of deposits and provision of investment and insurance services, Metro Bank PLC is authorised and regulated by the Financial Services Authority ('FSA'). In relation to consumer credit business, Metro Bank PLC is licensed and regulated by the Office of Fair Trading and not by the FSA. Most relevant deposits are protected by the Financial Services Compensation Scheme.  For further information about the Scheme refer to the FSCS website www.fscs.org.uk. 

All Metro Bank products are subject to status and approval.

Metro Bank PLC is an independent UK bank - it is not affiliated with any other bank or organisation (including the METRO newspaper or its publishers) anywhere in the world. Please refer to Metro Bank using the full name.

Metro Bank is led by a talented team of UK Executives:

• Craig Donaldson, Chief Executive Officer, formerly Managing Director of Retail Banking at Royal Bank of Scotland
• Paul Marriott-Clarke, Managing Director, Retail Banking, formerly Managing Director, Network South, Retail, HBOS
• Darren Schindler, Managing Director, Commercial Banking, formerly CEO, Oak Capital Group
• Aisling Kane, Chief Operations Officer, formerly Director of UK Operations at Anglo Irish Bank
• Mike Brierley, Chief Financial Officer, formerly Director, Business Risk at Barclaycard
• Mike Hudson, Chief Risk Officer, formerly Group Head of Risk at Hitachi Capital

Its non-executive directors are:

• Stuart Bernau, former Retail Director, Nationwide Building Society
• Keith Carby, Co-founder, J Rothschild Assurance
• Howard Flight, Founder, Guinness Flight Asset Management
• Ben Gunn, former Chief Executive of Friends Provident Life & Pensions
• Vernon Hill, Founder of Commerce Bank
• Eugene Lockhart, former CEO of Midland Bank and MasterCard International and former President, Global Retail Banking at Bank of America
• Graeme Hardie, Senior Adviser on Retail Markets to the Financial Services Authority (FSA)
• Anthony Thomson, Chairman, Financial Services Forum

About Trusteer

Trusteer is the world’s leading provider of Secure Web Access services. The company offers a range of services that detect, block and remove attacks launched directly against endpoints such as Man in the Browser, Man in the Middle and Phishing. Trusteer services are being used by leading financial organizations and enterprises in North America and Europe, and by tens of millions of their employees and customers to secure web access from mobile devices, tablets and computers to sensitive applications such as webmail, online payment, and online banking. HSBC, Santander, The Royal Bank of Scotland, SunTrust, Fifth Third, ING DIRECT, and BMO Financial Group are just a few of the companies using Trusteer’s technology. Trusteer is a privately held corporation led by former executives from RSA Security, Imperva, and Juniper. Follow us on www.Twitter.com/Trusteer. For more information about our services, please visit www.trusteer.com.

Source: Eskenzi PR

BitDefender warns Facebook scammers are targeting Twitter

Evidence suggests authors are looking to replicate their Facebook success

BitDefender^®, an award winning provider of innovative internet security solutions, offers evidence supporting the close connection between the Twitter scam reported by the Sophos naked security blog and a similar Facebook scam.

The BitDefender online threats team traced one of the URLs used to spread the #howlong Twitter attack and based on the advanced statistics provided by bit.ly managed to discover  that several Facebook scams such as ‘See your first status’, ‘See who viewed your profile’ and ‘Your top stalker’ had been disseminated from the same user account. This previously tested recipe turns out to be a success among microblogging fans, which confirms that scammers are not necessarily creative but highly profit oriented. Crucially, it also confirms that scams on Facebook are performed by the same people that send scams on Twitter.

Statistics illustrate the proportions of this phenomenon both in point of geographical distribution and click count. For example, two of the malicious URLs used in this scam gathered more than eight thousand clicks. While this may not be an impressive figure in itself, users should be aware that the most frequent scenario is for each Facebook scam wave to use more than two hundred URLs to spread.

George Petre, BitDefender Threat Intelligence Team Leader states, “The similarities between the two scams indicate that their authors did not go to too much trouble when creating them, but that they clearly had efficiency in mind. Considering that social networks are a common layer of all platforms, scam authors may have found the perfect medium in which to cleverly maximise impact and any revenue they may be able to make.”

For the full report please visit Malware City. For a full list of BitDefender 2011 features and benefits by product, please visit www.bitdefender.co.uk or follow BitDefender on Twitter for daily malware alerts.

About BitDefender®
BitDefender is the creator of one of the industry's fastest and most effective lines of internationally certified security software. Since its inception in 2001, BitDefender has continued to raise the bar and set new standards in proactive threat prevention. Every day, BitDefender protects tens of millions of home and corporate users across the globe - giving them the peace of mind of knowing that their digital experiences will be secure. BitDefender security solutions are distributed by a global network of value-added distribution and reseller partners in more than 100 countries worldwide. More information about BitDefender and its products are available at the company’s security solutions press room. Additionally, BitDefender’s www.malwarecity.com provides background and the latest updates on security threats helping users stay informed in the everyday battle against malware.