Search

The article discusses how to set up a data center with protected backup and restoration. There are numerous technologies and thousands of products available for backing up data. The place to begin is with an assessment of which data and systems need to be protected and what the cost would be if they were to go down. Computer user must look at two metrics, the recovery time objective (RTO) and recovery point objective (RPO). RTO will determine how long a particular machine or service can be down and RPO will describe how current the restored data must be and how often a backup must be done.

The article predicts emerging computer security threats for 2013. Topics include hacking of Internet browser software through malicious e-mail and text messages, large-scale breaches of database systems, and attempts to bypass identity protection password authentication measures. Also discussed is the potential for malware espionage or cyberterrorism against critical national infrastructure facilities through their supervisory control and data acquisition (SCADA) and incident command system (ICS) networks.

Advises on how to protect computers from threats of intrusion from coworkers or family members. Mention of CMOS passwords for security purposes; Importance of keeping the computer's case closed by using a locking mechanism; Tip on how to update an older computer without spending too much money. INSET: SLOW THE PRINTER FLOW.

Discusses privacy concerns in relation to computers and the Internet. Personal information in computer databases; Recommendation of Simson Garfinkel's 'Database Nation: The Death of Privacy in the 21st Century'; How highly sensitive medical information is traveling between health care and insurance industries often without legal restraint; Possibility of compromising a database; Argument that we need laws concerning privacy and security.

The article presents myths that companies must resist to protect movable media. It notes that the importance of protecting such media is a challenge to managers who believe in such myths. It mentions that companies believe that tapes are already obsolete. However, Ken Rubin, senior vice president of Iron Mountain states that putting a collection of tapes in a vehicle and driving it to a recovery site is an efficient thing to do. Another myth that companies believe in is that only technical people have the responsibility of protecting tapes and laptops. Companies also believe that once equipment are already protected, they are already secured.

The article discusses the importance of keeping stored data using encryption and key management. It mentions how Becu, the largest credit union in Washington upgrades its storage equipment by choosing an application that encrypts tapes in their tape library. It states that more companies are upgrading their storage equipment and are adopting advanced technological innovations such as tape drive and tape library encryption. It notes that data security involves the protection of stored information. According to Gartner Inc., companies need to encrypt data not just because they want to, but they have to.

The article discusses the ways on how to prevent computer fraud caused by handheld electronics. According to Fabi Gower, vice president of information systems at health care recruiting firm Martin, various handheld gadgets could lead to network and data corruption. To avoid this type of problem, he offers tips on how to protect data from handheld gadget leaks. Among the tips are development of comprehensive computer security policy, prevent the unauthorized access to the network, and monitor user access.

The article reports on the postponement of the proposed antiterrorism project for money transfers in the U.S. The U.S. Department of the Treasury released a report to the Congress that the project funding sources for terrorists are technically workable. However, the Financial Crimes Network (FinCEN) agency does not believe that the database could be used before March 2010. The FinCEN has proposed progressive development process that includes a complete cost-benefit analysis management from the financial services industry and law enforcement agencies.

The article discusses how messaging administrators backup and restore messages, and provides information for new technologies used. Increasingly, experts have begun to focus instead on changing their mail systems' underlying storage platform from server-based, direct-attached storage (DAS) to some type of storage-area network that offers more options for faster, disk-based e-mail backups and restores. Looking for new technologies, messaging administrators are moving away from DAS to networked storage that offers snapshot technology closely integrated with Microsoft Exchange and Microsoft Corp.'s Volume Shadow Copy Service.

The article provides steps on how to ensure efficient remote storage backups with branch offices. First, work with branch employees to schedule back-ups for times when they will cause the least disruption to operations. Make a complete backup every week, with incremental backups on successive days. Keep the past four weeks' worth of backups, then recycle the oldest of the daily media into the next rotation. Second, make sure someone is in charge at the branch. Finally, make sure to review branch's own rotation cycles to make sure on keeping older backups.

The article provides best practices and latest techniques on backing up the user's desktops and laptops. In formulating a desktop backup strategy, the first step is deciding what to back up. The most convenient approach in terms of planning and restoring is to simply back up all of the files. One solution to backing up data is consolidation. It is a relatively simple task to force data into one folder, especially if the user is standardized on one set of application. The best repository for user's desktop or laptop backups is a reasonable amount of space in his centralized storage.

The article discusses how new technologies helped to backup groupware. Computing workgroups face unique challenges when it comes to system backups. These groups use collaboration software that allows them to update and pass along files. Local area networks designed around workgroups provide electronic sharing of required data. These workgroups can operate on their own or within an enterprise and are typically outside the data center. Without adequate backups, some companies might not be in compliance with applicable regulations because their workgroup backup data is not protected.

The article reports on a survey of data backup and presents pie charts depicting results of the research. According to the study, top executives at their companies know how critical backup technology is and spend accordingly. Seventy percent of the respondents reported only an occasional hiccup in their backup procedures. Fifty-four percent said that less than half of their information technology staffers are well knowledgeable in their department's backup procedures, and about one-third said that their companies' backup procedures are not documented.

The article discusses ways on how to protect corporate databases. The protection of databases involves the implementation of key defenses such as access control and authentication, vulnerability scanners, data access monitors and encryption. One of the key drivers is the Payment Card Industry which specifies some requirements for all companies which are receiving credit cards including logical access control, periodic network scans, encrypted transmission of cardholder data, and activity monitoring and logging.

The article provides information on SecureSphere Database Security Gateway (DSG) which shields data from malicious acts and mistakes. SecureSphere DSG has the capability to protect systems from a wide variety of unwarranted activity by limiting the types of queries that can be run, the times they can be run and the client programs that can run them. Planning is key when installing SecureSphere DSG. SecureSphere DSG can filter queries in Learning, Static and Dynamic. The SecureSphere Database Security is considered a very important part of a complete database security model.

The article reports on the need for third-party security relevant to the use of databases in the United States citing the insufficiency of security services provided by major database vendors. The director of strategic development at Franklin, Tennessee-based AIM Healthcare Services Inc., Adam Solesby emphasized the lack of security features for its database, despite the amount of license fees they pay for these commercial databases. Vendors were recommended to supplement additional requirements in providing their services to enhance database security.

This article explains that Sybase Inc. threatened to sue Great Britain-based security research firm Next Generation Security Software Ltd. (NGS) if it publicly discloses the details of eight security vulnerabilities found in Sybase's database software Adaptive Server Enterprise Version 12.5.3. Sybase's move is evoking sharp criticism from information technology managers but sympathetic comments from others. An IT manager thinks blocking the release of vulnerability information would set a bad precedent for the software industry. The license agreement for the Development Edition of the software prohibits the publication of performance testing and benchmarking results without Sybase's permission.

Discusses the job of information technology (IT) professionals in the U.S. Importance of knowledge on return on investment; Outlook of IT security jobs after the September 11, 2001 terrorist attacks; Views on the roles of senior-level security managers; Skills that IT professionals must possess.

Deals with the management of data warehouses to address concerns about information technology privacy and security. Determination of the data that needs to be protected; Measurement of the technical controls around the people who have access to the warehouse; Features of the tools that pull data from the warehouse that can protect data sets.

Discusses how information system managers ensure security and integrity of distributed data. Challenges posed by spotting a break-in and finding the resources to audit security log files; Basic database rules; Human resource information system for workflow application based on an E-mail; Vendors' solutions to E-mail-based security issues; Replication systems; Distributive and collaborative application. INSET: Stalking the data trail..

Talks about the problem of computer data security. Details of losses of Recon Optical due to insufficient data protection; Views of experts on the problem; Survey of victims of defective information; Importance of physical security and its negligence by organizations; Views of David Grubb, computer security officer at Lawrence Livermore National Laboratory, on computer crimes; Methods to avoid the crimes.

The article reports on the survey conducted by the software products developer Oracle Corp. on the use of its security patches in companies The survey revealed that lack of corporate mandates to quickly install the firm's security patches may cause the exposure of Oracle database installations to jeopardy for extended periods of time. Oracle and the Independent Oracle Users Group (IOUG) are said to be working together to encourage more immense adoption of policies for deploying patches.

The article features several tales related to Information Technology. A scholar helps solve the problem encountered in a newly acquired Unix server of the local library, making them save $6,000 and getting firewall protection installed. Moreover, a software vendor has difficulties to have security group template set at the new computer and has ask the software manager replying to test the nightly process and was later told to stop e-mailing until the senior programmer checks the problem.

The article reports on the delays caused by a faulty hardware component to the DVD shipment of Netflix Inc. The shipping company did not reveal the specific hardware problem. However, Netflix IT operations head Mike Osierbut claimed that the hardware component that corrupted their database was already identified by Netflix engineers with the help of other technology suppliers. He said that the incident has prompted the company to strengthen further its system by adding undisclosed equipment and by working closely with its vendors.

The article focuses on the significance of collaboration in the workplace that could gain greater benefits for organizations who manages it properly. It refers the used of application tools in the Information Technology (IT), where it allows user to share opinions, co-create project-based Web-sites. Such tools could provide increased productivity and knowledge-sharing for real-time collaboration. It notes that these tools also pose a greater threat, but when manages properly less likely security breaches could occur.

The author presents various responses from readers regarding his article on the user-level tools he wanted. On his list, he wanted a universal serial bus (USB) key that unlocks his personal computer and handles all security in the simplest, complete and more transparent way. A reader responded that his idea was a bad one because it is a kind of tool that users always used to lose. An electronic mail filter was installed that blacklists foreign characters, such as Russian spam, and a reader suggested the Symantec Mail Security for Simple Mail Transfer Protocol (SMTP).

The author discusses the significance of working in compliance to the legislation that addresses the security of medical information that was developed by the U.S. Centers for Medicare & Medicaid Services (CMS) in the U.S. The author points out that the move aims to address the security of medical data and records as well as health-related information and impose penalties on identified security breaches. It states that the legislation requires health providers to report security crimes to director of the Division of State System of CMS and not to the Office of Information Security (OIS). The author also argues on the various changes that need to be carried out to comply with the requirements set by the CMS including business contracts and agreements.

The article reports that Commerce Bank NA has detected and stopped the hacking attempt on its database in the U.S. in October 2007. The bank discovered that a hacker had breached a database with about 3,000 customer records and had accessed 20 of them. Upon detection, law enforcement agencies have been immediately notified about the breach. Consequently, the bank has contacted all customers who have been affected to provide them with free credit monitoring services for two years. The way the hacking has been executed was reported by the bank.

The article reports on the security update of 11 gigabit database of Oracle Corp. which lacks support for grid technology in the U.S. Senior database administrator Ed Mulheren of Wachovia Corp. believes that the additional features will help the company meets regulatory demands as well as line up with its desktop security policies. Oracle claims that the updates will include advanced automation, self-management tools, data partitioning, compression capabilities and improvements in XML performance. Linux version of the database will be shipped in August 2007, however, price was not disclosed.

The article comments on the interest of the manager to have a more digital rights management (DRM) than his company could afford, and affirms that the company's compromise system turns out to better than nothing. The author states that he was one of the security managers in the company who is involved in the technical processes to implement a DRM. Being part of the implementation, the author hopes that the initiative would be a successful beginning in protecting the intellectual property of their business.

The article presents the ways on how to prevent computer fraud. Experts suggest 6 ways to prevent data leaks. These include getting control on the sensitive and proprietary data, keeping track of what's flowing over the networks, monitoring user access to critical data and detecting unauthorized access to high-risk data, and centralizing intellectual property data. Details related to the 6 ways on how to stop computer threats are discussed. Information on DuPont Corp.'s experience about data leaks is included.

The article focuses on the how to convey the importance of information security to the employees. According to chief information security officer Ed Zeitler, giving message to the employees about information security must be short and direct to the point so that employees could absorb the information well. Communicate them in various techniques and type of medium because they have different ways of learning and doing things. In addition, managers must have frequent face-to-face communication with younger employees. Included are tips on how to effectively communicate information security to workers.

The article focuses on the installation of client software that allows electronic mail to synchronize with the upper management's new smart phones in the U.S. According to the security managers, such policy is not necessary since the state's information technology (IT) Department has never been all that mobile. These smart phones demand client-side software that hooks into Microsoft Outlook. It has been stressed that security problem is difficult to fix because the upper management has a vested interest. However, this could be avoided by setting requirements for devices that satisfies security concerns.

The article presents an interview with Jon Fisher, chief executive officer of Bharosa, which sells anti-fraud and multifactor authentication technology. Fisher discusses the core intellectual property the company has which is a proprietary, gated methodology to screen for fraud in real time. Regarding what enterprises should know about the software available from the company, Fisher explains that fraud detection not only achieves Federal Financial Institutions Examination Council compliance, but it also brings together disparate legacy software. When asked if he is talking about single sign-on, Fisher says that single sign-on is an application.

The article reports on the argument between the members of the European Parliament and European Union justice ministers, over data privacy following a temporary agreement to provide airline passenger data to U.S. authorities. Members of parliament criticized the deal signed which grants U.S. government agencies to access to passenger records. According to European Parliament member Sylvia Kaufmann, the European Union has surrendered to U.S. demands on the access to passenger to passenger records. However, the Court of Justice rules that the old agreement would become invalid.

The article discusses how to protect data and software of pocket computers (PDAs). Almost all of the PDAs' data and software resides in volatile memory that provides some data protection. Proper handheld data management starts by avoiding the tendency to keep single copies of important data on a handheld. In addition, the best practice is to do daily backups to two memory cards, one of which resides in the devices during normal operation and can also hold applications and data. The other should be kept separate, in case the device is lost or stolen.

The article provides information on a guide that will back up the data safely and keep off from malfunction of the systems. It will protect data from systems failure, human error or natural disaster. This guide will back up data in six key areas of the information technology infrastructure. It includes the tried-and-true techniques and the latest technologies for backup the information. Because of this manual most information technology executives are comfortable and happy with their data backup.

The article presents unexpected experiences of the executives of information technology on their data that has been erased and did not save due to systems failure, human error or natural disaster. One is when the database administrators are performing to upgrade and backup files, a typical storm blew in that made the data erased. Next, the regular technician was fired when he unintentionally erased all the files of his supervisor. The other, a certain company lost its two years' worth of data at one site because of a former technician's mistake.

The article focuses on the reported poor protection of sensitive data in the offices of the U.S. Department of Homeland Security (DHS). The report claims that an important work remains to be done in areas of configuration, patch, and inventory management in its computer units. It has been found that certain procedures followed for patching laptops are lacking. It likewise demanded the Office of the Inspector General (OIG) to fix the configuration vulnerabilities and recommended procedures for better configuration management. In a written response dated June 14, 2006, a DHS official claims that the chief information officer in the OIG has set a plan for addressing the issues.

The article reports on the computer hackers' ability of covering security holes. Computer hackers used to create security problems and turn out as computer security researchers and experts. They also compete with each other to create credibility by finding security holes and tell the companies what they are about. However, vendors do not like the idea at all as security holes make them look bad. Computer hackers are not fully believed by companies since they are still hackers by heart. However, companies do not have much choice also but to trust them when it comes to covering security holes.

The article features AOL's restrictions on access to its databases of subscriber information to prevent further security breaches. Internet privacy watchdogs have criticized AOL for disclosing data on more than 2 million searches done in March, April and May. The Time Warner Inc. unit acknowledged that some of its researchers posted the data online, without mandated privacy reviews, even though it was supposed to be used only within AOL. In an e-mail message to employees that was released to the IDG News Service, AOL president Jon Miller said that an internal task force will determine how long the company should keep search data and other information. The company also plans to develop new systems to ensure that sensitive information is not included in its research databases.

The article offers news briefs related to computer security in the United States. Injection attacks on several organization's databases were reported by SecureWorks Inc. while a program on virus naming was launched by the antivirus industry for easy identification of malicious codes. Rich Mogull of Gartner Inc. talks about savings on security spending to security technology effective organizations.

The article reports on the criticism of the Government Accountability Office to the U.S. Department of Homeland Security's (DHS) data security and information technology contract management shortcomings within its program for controlling and monitoring the entry and visa status of foreign visitors. The GAO argued that the agency officials responsible for the U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) program did no establish effective financial controls for overseeing work performed on its behalf by other agencies. In addition, GAO also claimed that the program office did not understand exactly how much was being spent on contracts or whether the work was being done on time and within budgets. In these regard, Richard Skinner, inspector at the DHS, responded that the agency has not properly configured a database in which personal information captured by radio frequency identification devices is stored.

The article reports on the privacy risks of the creation of statewide voter databases as mandated for all states by the federal Help America Vote Act in the U.S. Under the Help America Vote Act, all states create centralized, statewide voter registration databases, but it did not mandate any protections for that data. People are required to provide personal information, such as date and place of birth and current residence when people register to vote in the country. According to Freddie Oakley, clerk recorder for Yolo County, California, she fears that a loss of local control could diminish the security of voter data.

The article features Amichai Shulman, chief technology officer (CTO) and founder of Imperva. He heads the company's Application Defense Center (ADC), a research arm of the company devoted to building the most advanced, security knowledge base in the world. He was former CTO at Edvice, an application-and-database security consultancy. According to Shulman, there are many good public research organizations for Web servers and Web security, but fewer for database security. He notes that critical vulnerabilities exist in commercial database servers.

The article reports that customers are being notified by San Francisco, California-based Wells Fargo & Co. about the theft of a computer which is containing data on mortgage customers and prospective clients. This is the fourth incident in a series of embarrassing and nearly identical data breaches that have taken place in the past 30 months. On May 5, 2006, a statement was posted by the bank on its Web site saying that the computer was reported missing while being transported between Wells Fargo facilities by an undisclosed global express shipping company. The stolen computer, which belonged to the company's mortgage group, contained various types of customer data, such as names, addresses, Social Security numbers and mortgage loan account numbers. According to a company spokesman, so far, there's no indication that the information kept on the computer has been misused.

The article reports that Oracle Corp. has released 14 software patches that address security vulnerabilities in its databases, application server software and other products in the U.S. As part of the quarterly software update, it also released a tool designed to ferret out commonly used default passwords that could be misused by hackers. According to Darius Wiles, manager of security alerts at Oracle, earlier versions of Oracle databases included well-known default passwords and usernames. It also features the Oracle10g databases that have been upgraded from its previous versions.

The article discusses data security policies. Information technology managers who attended the annual InfoSec World conference has agreed to the keys of corporation information security policies. These objectives are focus, simplicity, and enforceability. Policies are mandatory. Companies must be clear on their security policies. Workers should understand them well and documents must be readily accessible. They must be enforced easily. Also, not to be overlooked are the exceptions. A formal process should be developed for this area.

The article evaluates the Imperva SecureSphere Database Security Gateway software from Imperva and offers information on features, capability and cost.

Reports and comments on several issues relevant to computer security and database management and security in the U.S. in 2005.