Search

This article reports on what information technology managers said about security metrics. Metrics that measure only the performance of security personnel and the tools they use are of limited value when it comes to assessing the true effectiveness of data protection investments. A better approach is to combine information security metrics with other performance indicators, such as the effect that security problems have on internal business processes or the availability of applications to end users.

Recounts the author's experience with a top-down information security plan. Absence of a plan that would show the integration of information security into the mission, goals, and objectives of the organization; Surprise over a top-down directive from a governor requiring that the state's chief information security officer gather plans from all the state agencies; Results of documenting and auditing information security efforts.

This article addresses the issue of endpoint security. The compliance requirements for protecting data against loss, the risk to the organization of intellectual property theft, and the support challenges arising from corrupted personal computers (PC) and laptops make a strong case for tighter endpoint controls. However, users do not like endpoint security controls. They will accept antivirus and antispyware agents, and they may grudgingly accept a desktop firewall. But most users will grumble about anything that restricts the flexibility and freedom that the PC has come to represent.

Reports on developments on topics related to the computer security. Results of the survey on consumers' confidence in the security of online transactions; Release of a bundle of security patches for Oracle Corp.'s software; Findings of Arbor Networks Inc.'s Worldwide ISP Security Report.

This article reports on the impact of the upgrade of Cisco Systems Inc.'s (CS) Network Admission Control (NAC) technologies. This upgrade adds wider hardware support and several features designed to help companies better protect their networks against insecure endpoint devices. As part of the NAC initiative, CS is selling a line of tools that can permit, restrict or deny admission to corporate networks based on the security status of end-user systems. The products include agent software for collecting security data from client systems, network appliances that enforce security rules, and a policy management server.

This article reports that information security staffers at the American Red Cross, which was hit by the Zotob worm, are working overtime to try to protect the organization's networks against attacks amid surges in usage of the networks following Hurricane Katrina. In addition, the emergency relief agency has turned to the Federal Bureau of Investigation and others for help in preventing the spread of imitation Red Cross Web sites set up by scam artists. Zotob, which took advantage of a hole in the plug-and-play component in Microsoft Corp.'s Windows software, saturated sections of the Red Cross' networks, making them inaccessible to users for several hours.

Shares the author's approach in managing information security priorities given budgetary constraints. Spending decision on intrusion detection systems; Need to make an evaluation, pilot or validation testing before finalizing purchasing decisions; Assurance that the corporate network is protected from unsuspecting employees.

This article reports that the Security Compliance Council plans to create standard measures to assess and benchmark information security performance. Information technology managers said that such tools can be effective, but they listed several challenges facing the new organization. The effort's chances for success will depend largely on how it builds on existing security frameworks and processes.

Presents the findings of the Pew Internet & American Life Project survey of Internet users about spyware and related problems and of a Ponemon Institute survey of 400 people who were victims of a personal data breach. Neither study is intended to be about changing what users do for computer security measures. The main thing that is clear from both studies is that fear, anger and distrust are what motivate users to change. In the Pew survey, 91 percent of users said that fears about malware have made them change how they deal with electronic mail, the Web, downloads and even software user agreements. And, according to the Ponemon survey, most of those whose personal information is leaked will dump the bank, credit card or other company that exposed their data.

This article presents technology trends, new products, news and industry gossip in the information technology sector in the U.S. as of November 8, 2004. John Norcross, vice president of technology at Celerant Consulting Inc., warns of an impending IT expertise crisis. The release of rival offerings AirDefense 6.0 and Predator Watch Auditor 128 is expected to reinforce wireless defenses. Joelle Groeper Kaufman, vice president of marketing at Reactivity Inc., says that Web services need more than well-intended standards. Lastly, Brian Cincera, vice president of security solutions at Greenwich Technology Partners Inc. shares his advise about iPods and MP3 players as vehicles for stealing a company's data.