Search

The article discusses how to set up a data center with protected backup and restoration. There are numerous technologies and thousands of products available for backing up data. The place to begin is with an assessment of which data and systems need to be protected and what the cost would be if they were to go down. Computer user must look at two metrics, the recovery time objective (RTO) and recovery point objective (RPO). RTO will determine how long a particular machine or service can be down and RPO will describe how current the restored data must be and how often a backup must be done.

The article predicts emerging computer security threats for 2013. Topics include hacking of Internet browser software through malicious e-mail and text messages, large-scale breaches of database systems, and attempts to bypass identity protection password authentication measures. Also discussed is the potential for malware espionage or cyberterrorism against critical national infrastructure facilities through their supervisory control and data acquisition (SCADA) and incident command system (ICS) networks.

The article reports on the repair of encryption failures for Enigmail email security extension for Thunderbird. An overview about the Enigmail which provides a graphical user interface in the Mozilla Thunderbird and SeaMonkey programs is provided. The developers have fixed several issues that could have exposed messages users believed to be encrypted.

The article reports on the issues arise following the discovery of stolen online credential database by Russian hackers. Noted is the stance of some security researchers on the clarity of the incidence and in faulting Hold Security LLC, the company that uncovered the stolen credentials, for not providing more details of it. The researchers also raise questions on the age of the credentials, their origin and the security of passwords.

Advises on how to protect computers from threats of intrusion from coworkers or family members. Mention of CMOS passwords for security purposes; Importance of keeping the computer's case closed by using a locking mechanism; Tip on how to update an older computer without spending too much money. INSET: SLOW THE PRINTER FLOW.

The article reports that several Western Australian (WA) government agencies have been asked to improve their database security after the state's auditor general Colin Murphy found weak passwords, inadequate patching and a lack of control over user privileges during an audit, as of November 2015. Topics include the systems audited in several agencies including Murdoch University, WA Department of Health, and the Department of Attorney General.

The article discusses the ways on how to prevent computer fraud caused by handheld electronics. According to Fabi Gower, vice president of information systems at health care recruiting firm Martin, various handheld gadgets could lead to network and data corruption. To avoid this type of problem, he offers tips on how to protect data from handheld gadget leaks. Among the tips are development of comprehensive computer security policy, prevent the unauthorized access to the network, and monitor user access.

The article discusses how messaging administrators backup and restore messages, and provides information for new technologies used. Increasingly, experts have begun to focus instead on changing their mail systems' underlying storage platform from server-based, direct-attached storage (DAS) to some type of storage-area network that offers more options for faster, disk-based e-mail backups and restores. Looking for new technologies, messaging administrators are moving away from DAS to networked storage that offers snapshot technology closely integrated with Microsoft Exchange and Microsoft Corp.'s Volume Shadow Copy Service.

The article provides steps on how to ensure efficient remote storage backups with branch offices. First, work with branch employees to schedule back-ups for times when they will cause the least disruption to operations. Make a complete backup every week, with incremental backups on successive days. Keep the past four weeks' worth of backups, then recycle the oldest of the daily media into the next rotation. Second, make sure someone is in charge at the branch. Finally, make sure to review branch's own rotation cycles to make sure on keeping older backups.

The article provides best practices and latest techniques on backing up the user's desktops and laptops. In formulating a desktop backup strategy, the first step is deciding what to back up. The most convenient approach in terms of planning and restoring is to simply back up all of the files. One solution to backing up data is consolidation. It is a relatively simple task to force data into one folder, especially if the user is standardized on one set of application. The best repository for user's desktop or laptop backups is a reasonable amount of space in his centralized storage.

The article discusses how new technologies helped to backup groupware. Computing workgroups face unique challenges when it comes to system backups. These groups use collaboration software that allows them to update and pass along files. Local area networks designed around workgroups provide electronic sharing of required data. These workgroups can operate on their own or within an enterprise and are typically outside the data center. Without adequate backups, some companies might not be in compliance with applicable regulations because their workgroup backup data is not protected.

The article reports on a survey of data backup and presents pie charts depicting results of the research. According to the study, top executives at their companies know how critical backup technology is and spend accordingly. Seventy percent of the respondents reported only an occasional hiccup in their backup procedures. Fifty-four percent said that less than half of their information technology staffers are well knowledgeable in their department's backup procedures, and about one-third said that their companies' backup procedures are not documented.

The article discusses ways on how to protect corporate databases. The protection of databases involves the implementation of key defenses such as access control and authentication, vulnerability scanners, data access monitors and encryption. One of the key drivers is the Payment Card Industry which specifies some requirements for all companies which are receiving credit cards including logical access control, periodic network scans, encrypted transmission of cardholder data, and activity monitoring and logging.

The article provides information on SecureSphere Database Security Gateway (DSG) which shields data from malicious acts and mistakes. SecureSphere DSG has the capability to protect systems from a wide variety of unwarranted activity by limiting the types of queries that can be run, the times they can be run and the client programs that can run them. Planning is key when installing SecureSphere DSG. SecureSphere DSG can filter queries in Learning, Static and Dynamic. The SecureSphere Database Security is considered a very important part of a complete database security model.

This article explains that Sybase Inc. threatened to sue Great Britain-based security research firm Next Generation Security Software Ltd. (NGS) if it publicly discloses the details of eight security vulnerabilities found in Sybase's database software Adaptive Server Enterprise Version 12.5.3. Sybase's move is evoking sharp criticism from information technology managers but sympathetic comments from others. An IT manager thinks blocking the release of vulnerability information would set a bad precedent for the software industry. The license agreement for the Development Edition of the software prohibits the publication of performance testing and benchmarking results without Sybase's permission.

Talks about the problem of computer data security. Details of losses of Recon Optical due to insufficient data protection; Views of experts on the problem; Survey of victims of defective information; Importance of physical security and its negligence by organizations; Views of David Grubb, computer security officer at Lawrence Livermore National Laboratory, on computer crimes; Methods to avoid the crimes.

CIOs are being warned that complying with PCI DSS (data security standards) is just as much about technology as it is security. [ABSTRACT FROM AUTHOR]

The article reports on the delays caused by a faulty hardware component to the DVD shipment of Netflix Inc. The shipping company did not reveal the specific hardware problem. However, Netflix IT operations head Mike Osierbut claimed that the hardware component that corrupted their database was already identified by Netflix engineers with the help of other technology suppliers. He said that the incident has prompted the company to strengthen further its system by adding undisclosed equipment and by working closely with its vendors.

Information security experts have been steadily increasing their awareness and concern over the risks associated with poorly managed Serial Control and Data Acquisition systems (SCADA), normally used to control and manage public utilities, such as sewage, power, water, and other electronic interfaces to engineered systems. [ABSTRACT FROM AUTHOR]

The industry's first cyber-security vulnerability database for industrial control systems was launched this week by security solutions provider Wurldtech Security Technologies. [ABSTRACT FROM AUTHOR]

The author discusses the significance of working in compliance to the legislation that addresses the security of medical information that was developed by the U.S. Centers for Medicare & Medicaid Services (CMS) in the U.S. The author points out that the move aims to address the security of medical data and records as well as health-related information and impose penalties on identified security breaches. It states that the legislation requires health providers to report security crimes to director of the Division of State System of CMS and not to the Office of Information Security (OIS). The author also argues on the various changes that need to be carried out to comply with the requirements set by the CMS including business contracts and agreements.

The article reports on the security update of 11 gigabit database of Oracle Corp. which lacks support for grid technology in the U.S. Senior database administrator Ed Mulheren of Wachovia Corp. believes that the additional features will help the company meets regulatory demands as well as line up with its desktop security policies. Oracle claims that the updates will include advanced automation, self-management tools, data partitioning, compression capabilities and improvements in XML performance. Linux version of the database will be shipped in August 2007, however, price was not disclosed.

The article presents the ways on how to prevent computer fraud. Experts suggest 6 ways to prevent data leaks. These include getting control on the sensitive and proprietary data, keeping track of what's flowing over the networks, monitoring user access to critical data and detecting unauthorized access to high-risk data, and centralizing intellectual property data. Details related to the 6 ways on how to stop computer threats are discussed. Information on DuPont Corp.'s experience about data leaks is included.

The article focuses on the how to convey the importance of information security to the employees. According to chief information security officer Ed Zeitler, giving message to the employees about information security must be short and direct to the point so that employees could absorb the information well. Communicate them in various techniques and type of medium because they have different ways of learning and doing things. In addition, managers must have frequent face-to-face communication with younger employees. Included are tips on how to effectively communicate information security to workers.

The article focuses on the installation of client software that allows electronic mail to synchronize with the upper management's new smart phones in the U.S. According to the security managers, such policy is not necessary since the state's information technology (IT) Department has never been all that mobile. These smart phones demand client-side software that hooks into Microsoft Outlook. It has been stressed that security problem is difficult to fix because the upper management has a vested interest. However, this could be avoided by setting requirements for devices that satisfies security concerns.

The article presents an interview with Jon Fisher, chief executive officer of Bharosa, which sells anti-fraud and multifactor authentication technology. Fisher discusses the core intellectual property the company has which is a proprietary, gated methodology to screen for fraud in real time. Regarding what enterprises should know about the software available from the company, Fisher explains that fraud detection not only achieves Federal Financial Institutions Examination Council compliance, but it also brings together disparate legacy software. When asked if he is talking about single sign-on, Fisher says that single sign-on is an application.

The article reports on the argument between the members of the European Parliament and European Union justice ministers, over data privacy following a temporary agreement to provide airline passenger data to U.S. authorities. Members of parliament criticized the deal signed which grants U.S. government agencies to access to passenger records. According to European Parliament member Sylvia Kaufmann, the European Union has surrendered to U.S. demands on the access to passenger to passenger records. However, the Court of Justice rules that the old agreement would become invalid.

The article discusses how to protect data and software of pocket computers (PDAs). Almost all of the PDAs' data and software resides in volatile memory that provides some data protection. Proper handheld data management starts by avoiding the tendency to keep single copies of important data on a handheld. In addition, the best practice is to do daily backups to two memory cards, one of which resides in the devices during normal operation and can also hold applications and data. The other should be kept separate, in case the device is lost or stolen.

The article provides information on a guide that will back up the data safely and keep off from malfunction of the systems. It will protect data from systems failure, human error or natural disaster. This guide will back up data in six key areas of the information technology infrastructure. It includes the tried-and-true techniques and the latest technologies for backup the information. Because of this manual most information technology executives are comfortable and happy with their data backup.

The article presents unexpected experiences of the executives of information technology on their data that has been erased and did not save due to systems failure, human error or natural disaster. One is when the database administrators are performing to upgrade and backup files, a typical storm blew in that made the data erased. Next, the regular technician was fired when he unintentionally erased all the files of his supervisor. The other, a certain company lost its two years' worth of data at one site because of a former technician's mistake.

The article focuses on the reported poor protection of sensitive data in the offices of the U.S. Department of Homeland Security (DHS). The report claims that an important work remains to be done in areas of configuration, patch, and inventory management in its computer units. It has been found that certain procedures followed for patching laptops are lacking. It likewise demanded the Office of the Inspector General (OIG) to fix the configuration vulnerabilities and recommended procedures for better configuration management. In a written response dated June 14, 2006, a DHS official claims that the chief information officer in the OIG has set a plan for addressing the issues.

The article reports on the computer hackers' ability of covering security holes. Computer hackers used to create security problems and turn out as computer security researchers and experts. They also compete with each other to create credibility by finding security holes and tell the companies what they are about. However, vendors do not like the idea at all as security holes make them look bad. Computer hackers are not fully believed by companies since they are still hackers by heart. However, companies do not have much choice also but to trust them when it comes to covering security holes.

The article offers news briefs related to computer security in the United States. Injection attacks on several organization's databases were reported by SecureWorks Inc. while a program on virus naming was launched by the antivirus industry for easy identification of malicious codes. Rich Mogull of Gartner Inc. talks about savings on security spending to security technology effective organizations.

The article reports on the criticism of the Government Accountability Office to the U.S. Department of Homeland Security's (DHS) data security and information technology contract management shortcomings within its program for controlling and monitoring the entry and visa status of foreign visitors. The GAO argued that the agency officials responsible for the U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) program did no establish effective financial controls for overseeing work performed on its behalf by other agencies. In addition, GAO also claimed that the program office did not understand exactly how much was being spent on contracts or whether the work was being done on time and within budgets. In these regard, Richard Skinner, inspector at the DHS, responded that the agency has not properly configured a database in which personal information captured by radio frequency identification devices is stored.

The article features Amichai Shulman, chief technology officer (CTO) and founder of Imperva. He heads the company's Application Defense Center (ADC), a research arm of the company devoted to building the most advanced, security knowledge base in the world. He was former CTO at Edvice, an application-and-database security consultancy. According to Shulman, there are many good public research organizations for Web servers and Web security, but fewer for database security. He notes that critical vulnerabilities exist in commercial database servers.

The article reports that customers are being notified by San Francisco, California-based Wells Fargo & Co. about the theft of a computer which is containing data on mortgage customers and prospective clients. This is the fourth incident in a series of embarrassing and nearly identical data breaches that have taken place in the past 30 months. On May 5, 2006, a statement was posted by the bank on its Web site saying that the computer was reported missing while being transported between Wells Fargo facilities by an undisclosed global express shipping company. The stolen computer, which belonged to the company's mortgage group, contained various types of customer data, such as names, addresses, Social Security numbers and mortgage loan account numbers. According to a company spokesman, so far, there's no indication that the information kept on the computer has been misused.

The article reports that Oracle Corp. has released 14 software patches that address security vulnerabilities in its databases, application server software and other products in the U.S. As part of the quarterly software update, it also released a tool designed to ferret out commonly used default passwords that could be misused by hackers. According to Darius Wiles, manager of security alerts at Oracle, earlier versions of Oracle databases included well-known default passwords and usernames. It also features the Oracle10g databases that have been upgraded from its previous versions.

The article discusses data security policies. Information technology managers who attended the annual InfoSec World conference has agreed to the keys of corporation information security policies. These objectives are focus, simplicity, and enforceability. Policies are mandatory. Companies must be clear on their security policies. Workers should understand them well and documents must be readily accessible. They must be enforced easily. Also, not to be overlooked are the exceptions. A formal process should be developed for this area.

The article evaluates the Imperva SecureSphere Database Security Gateway software from Imperva and offers information on features, capability and cost.

Reports and comments on several issues relevant to computer security and database management and security in the U.S. in 2005.

Our security manager takes a look at the agency's informational assets and realizes the application layer is the weak link. 'Asset-centric security' seems to be becoming a familiar phrase in the security world. However, identifying assets can be complicated. For many organizations, assets are pieces of information stored in numerous places: on local hard drives, on file servers, within databases, in various physical and geographical locations, as well as in transit. The information could include customer or client data, protected health data, proprietary information or financial data, among other things. Thinking through the layers of security in our environment, I realized that the weakest link in the chain is at the application layer, which is where I see database security fitting in. Much attention has been given to auditing firewall rules, turning off unneeded services on servers and patching operating systems, internetwork operating systems and various applications, such as Internet Explorer. But it seems that not much attention has been given to database security and auditing. I know for a fact that no attention has been paid to it here, and I need to do something about that, though I don't have much experience in the subject.

Reports developments related to computer security in the U.S. as of August 9, 2004. Availability of the book "Network Security Hacks," by Andrew Lockhart; Topics discussed in the book; Release of a database security software by Guardium Inc.

This article reports that Oracle Corp.'s effort to portray itself as a vendor of unbreakable technology received a setback when a British bug hunter disclosed that he had found 34 security vulnerabilities in the database vendor's products in the U.S. The flaws include several that could allow malicious attackers to gain complete administrative control of compromised database servers. They include buffer overflows, SQL injection issues, and a whole range of other minor issues. Some of the flaws can be exploited without a user ID and password, while others require them.

Reviews the database management software DeepSight Threat Management System 5.0 from Symantec Corp.

Focuses on the content security software used by companies to prevent data corruption and productivity loss.