Search

This section offers steps on how to start with a service-oriented architecture (SOA). It was learned that SOA builds on the stack of protocols that define Web services. It is a broad, standards-based framework in which services are built, deployed, managed, and orchestrated in pursuit of new infrastructures that respond to shifting business demands. SOA starts with a business promise of enabling enterprises to re-engineer themselves. The more dynamic the business, the more it will benefit from a well-implemented SOA. Before implementation, it is recommended to survey surroundings. An SOA involves a sprawling set of technologies. Another step is the connection of first services. Coming next is the selection and deployment of a registry or repository. The issue of convergence should come next. Security plans must be laid and a messaging infrastructure must be built. The last two steps is the deployment of service management and orchestration.

The article focuses on the benefits of virtual private networks (VPN) for data protection by business users of the iPad tablet computer. The iPad supports three kinds of VPNs Point-to-Point tunneling Protocol (PPtP), Layer 2 tunneling Protocol (L2tP), and Cisco Internet Protocol Security (IPSec). It explains the method for configuring a VPN setup and procedure for using it.

This article presents tips on using the Internet and avoiding e-mail attacks. According to the author, it is advisable to assume any message as malicious. Next, use a new found paranoia to examine messages critically. Even messages that appear to come from firms where a user has an account, may not be real. Before clicking a link or taking any action requested in a message, determine for certain that the message is genuine. Return addresses, embedded links, and images can deceive. Look for dire warnings and other classic con techniques, undoubtedly accompanied by a link to a bogus Web site where the user will be asked to enter personal information. As a clue, the phishing message may be delivered to an e-mail address that the user don't use with that company or institution. The author emphasized that if a user get a message at an address he or she never registered with, the e-mail is fake. Intuition and a suspicious nature are a good start, but to separate real messages from bogus ones, the user also need to decipher their Web addresses. Another clue is the string of numbers following the URL prefix http://. It should be remembered that every Web site resides at a specific Internet Protocol address. INSET: Nvu Brings Free Web Authoring to the Firefox Browser.

This article discusses emerging information technology (IT) standards that have an impact on computer security, data protection, and computer network security in enterprises. The Control Objectives for Information and Related Technology (COBIT) is gaining acceptance as good practice for control of data, systems, and related risk. ISO 27001 is entitled "Information Security Management—Specification With Guidance for Use. The book series "IT Infrastructure Library" is designed to help technology-usage costs. The Statement on Auditing Standards Number 70 came from the American Institute of Certified Public Accountants. INSET: Future Of NIST.

The article reports on the network-based monitoring systems, which will detect and block outbound traffic containing sensitive data. The problem is not just the content within e-mail messages, but the explosion of alternative communication mechanisms that employees are using, including instant messaging, blogs, File Transfer Protocol transfer, Web mail and message boards. Network-based content monitoring and control tools take a broad-brush approach, examining all crosses the network unlike security tools that protect specific applications such as e-mail or instant messaging. INSET: Block That Swap.

This article presents of list of reviews of several security products, including virtual private networks, vulnerability assessment offerings and some backup solutions. Netilla Security Platform Release 4.0 is a reliable security platform with built-in fail-over support, this box offers solid security, straightforward policy definition and a nice portal for end-users. However, policy management is not as easy as it could be, the range of Secure Sockets Layer cipher levels is limited and it lacks Lightweight Directory Access Protocol support. Symantec DeepSight Threat Management System 5.0 is a boon to large enterprises that need a lot of warning to prepare for attacks on vulnerabilities. The service provides detailed intelligence about activities that could be attacks and confirmed vulnerabilities. Information is presented clearly, identifying threat levels and threat trends. Although pricey, the nCircle IP360 Vulnerability Management System is a thorough, well-designed network vulnerability scanning solution that would benefit any large network. Dispersed scanners allow continuous scanning without consuming a lot of bandwidth. Application detection accuracy is solid. Easy to operate and extremely thorough, Sanctum AppScan DE 1.7 is a worthwhile tool for developers interested in shoring up a Web application's security.

The article discusses the concerns among some security experts that denial-of-service (DoS) attacks could be launched against core routers and switches which were raised upon the disclosure in April 2004 of two serious flaws in widely used Internet technologies. One of the vulnerabilities involves Cisco Systems' implementation of the Simple Network Management Protocol in its Internetworking Operating System. The flaw could allow remote attackers to cause vulnerable systems to repeatedly restart when processing specific SNMP requests, eventually leading to DoS conditions. According to Amit Yoran, director of the U.S. Department of Homeland Security's National Cyber Security Division, the flaw is particularly dangerous because it affects a wide range of Cisco's routers and switches and is very easy to exploit. Meanwhile, a US-CERT advisory warned of a critical flaw in the Internet's core Transmission Control Protocol (TCP). The flaw allows remote attackers to create DoS conditions against TCP connections, with sustained attacks capable of disrupting portions of the Internet, the advisory stated. The flaw was disclosed by Great Britain's National Infrastructure Security Co-ordination Centre and involved a long-known weakness in TCP that allows attackers to constantly reset routers by guessing a unique 32-bit number needed for the process.

Evaluates the NetSwift iGate Pro Secure Sockets Layer Virtual Private Network appliance from Rainbow Technologies. Key features; Capabilities; Sites and connectors used in the iGate.

Reports on the plan of Cisco Systems Inc. to issue a warning about a security threat to its user authentication technology for wireless local area networks. Vulnerability of Cisco's Lightweight Extensible Authentication Protocol (LEAP) algorithm to dictionary attacks; Services offered by Cisco; Decision of the University of British Columbia in Vancouver to use virtual private network technology instead of LEAP.

Discusses the application of Internet Protocol security (IPsec) for client/server information technology infrastructure. Application of IPsec for virtual private network; Implications of the proliferation of Web-based technology; Computer devices affected by the application of Secure Sockets Layer protocol.

Provides information on Secure Sockets Layer (SSL) virtual private networks (VPN). Capabilities of SSL VPN; Comparison between SSL VPN and Internet Protocol Security-based VPN; Disadvantages of using SSL VPN.

Provides information on the Wi-Fi Protected Access security standard of the Wi-Fi Alliance in the U.S. Protocol used by the standard as a replacement for the Wired Equivalent Privacy; Features; Security methods on which vendors are focusing.

Focuses on the weaknesses in the Wi-Fi, or 802.1x, a security protocol for wireless networks. Three parts of 802.1x authentication; Vendors that have already begun adding 802.1x support to their products; Options to ensure a secure wireless network. INSET: THE BOTTOM LINE.

Two letters to the editor are presented in response to the articles "Do ISPs Pose a Bigger Online Privacy Threat Than Google?" in the September 15, 2008 issue and "Context of Collapse" in the September 22, 2008 issue.

The article presents the views of the author on how information technology (IT) departments should respond to the threat concerning the early switch of daylight-saving time (DST) in the U.S. He stresses that the application of Network Time Protocol (NTP) by system administrators can help address the synchronization of clocks in computer systems over data networks. It was inferred that compliance of computer programs to time zones and DST rules is significant to prevent failures in applications and systems. The author argues that it conducted an evaluation on all IT servers to ensure that every server was DST compliant. He asserts that the evaluation enables them to install programs that address the security of operating systems.

The article focuses on the views of the author on how information technology (IT) departments should respond to the threat concerning the early switch of daylight-saving time (DST) in the U.S. He stresses that the application of Network Time Protocol (NTP) by system administrators can help address the synchronization of clocks in computer systems over data networks. It was inferred that compliance of computer programs to time zones and DST rules is significant to prevent failures in applications and systems. The author argues that it conducted an evaluation on all IT servers to ensure that every server was DST compliant. He asserts that the evaluation enables them to install programs that addresses the security of operating systems.

The author discusses some strategic objectives for intellectual property protection. The author company's networks, which was newly installed with a Multiprotocol Label Switching network, have been infected with a computer virus that led him to worry regarding visitors access to their intellectual property. After upgrading of their network, he mandated segmentation, with the internal desktop network clearly separated from public areas to authorized limited Internet access. He also proposes deploying digital rights management and a content monitor with the Microsoft's Right Management Services.

The article presents a mapping service for mobile users. Skyhook Wireless Inc. located in Boston, Massachusetts released a beta version of their Loki mapping. This is a free Loki toolbar added to the Web browser. It can register the location of laptops in a company's database of 5 million Wi-Fi access points in the U.S. Commercial users and security managers can use the tool for tracking equipment and machines that are equipped with laptops. A total of 100 Skyhook employees man a 15 to 20 miles of major urban areas to help pinpoint the locations of access points.

This article reports on the need for better Session Initiation Protocol (SIP) traffic due to the growing interest in SIP-enabled communications as of October 2005. SIP is a signaling protocol used to establish connectivity between two session end points. Covergence will provide its answer to the SIP security question at Gartner Symposium/ITExpo this week by unveiling Eclipse, a Linux-based appliance that manages the connectivity and performance of SIP services and applications. Acting as both perimeter and internal defense system. Eclipse secures access to SIP applications and SIP-enabled PBXes and phones, making it a natural fit in VoIP security plans. Beyond VoIP, it can apply security policies to SIP traffic, monitor network capacity, and log and record application traffic to comply with industry regulations.

This article discusses how a service layer makes service-oriented architectures (SOA) easier to manage and update. Most companies looking seriously at SOA do so in hopes of making a mishmash of existing hardware and software play together more smoothly. Such companies have much to gain from SOA. But they face a key challenge in that heterogeneous environments bring together a plethora of brands, platforms, protocols, security systems and more, making SOA standardization more difficult to achieve. Even if the chief architect of a company solves the problem by dictating, the Web services policy--the set of requirements for using any given service--must be abstracted from the services themselves in order for the SOA to scale. This is exactly the type of practical concern for which the InfoWorld SOA Executive Forum was created, to be held in San Jose, California, on May 5, 2005 and in New York on May 17, 2005. Eric Pulier, executive chairman of SOA Software, said that if an individual has exposed his or her applications as Web services but the security procedures and other policies are hard-coded into the applications, then every change requires him or her to re-code the applications. That is equivalent to an old-style tightly coupled application-to-application interface. The smart solution is to handle such complexities in a service layer, integral to the SOA. Some companies write this layer themselves, others seek a prepackaged solution such as the one offered by SOA Software. In either case, the service layer knows where each service resides, what it knows, and what it needs. It then acts as a nexus for communication, security and so forth. Upgrading a protocol, then, requires you to change the service layer rather than several applications.

This article features the Web site filter 5.0 of SurfControl. SurfControl has updated its complete line of Internet content-filtering products. Web Filter 5.0 adds a spyware category to its threat database, as well as the ability to block p-to-p application sites. Administrators can now monitor all SurfControl installations from a single console. In addition, the product's filtering agent has been enhanced for greater accuracy. Instant Message Filter 2.5 supports the latest AIM, ICQ, MSN, and Yahoo! messaging protocols, as well as the BitTorrent, OpenNapster, and WinMX p-to-p networks. The Mobile Filter product facilitates filtering for remote or seldom-connected users. In a typical 500-user installation. Web Filter costs $19 per user. Instant Message Filter costs $9.50 per user, and Mobile Filter costs $6.65 per user with a $2,500 one-time server fee.

The article details the deployment of a secure e-mail using transport layer security (TLS) protocol. The financial services company for which I am consulting is setting up secure e-mail links with several customers to protect messages containing sensitive financial data. The traditional approach to e-mail security is to use a desktop encryption product that is compliant with one of the two common standards:S/MIME or OpenPGP. My employers are taking a different approach: They are sending their e-mail using TLS, which is essentially the latest incarnation of the Secure Sockets Layer protocol. You can use TLS to open secure channels between e-mail servers. Once two e-mail servers start talking TLS to each other, they can pass all their normal e-mail traffic over that secure channel. One problem is that TLS secures only the link between the two e-mail servers. It provides no protection after the message has been reached the destination server, so confidential e-mails are still unprotected on another company's server. Then there is the issue of digital certificates. Like any good encryption protocol, TLS uses them to prove the identity of the sender and the receiver. Then we hit the enforcement issue. You can set your e-mail servers to one of two modes: opportunistic TLS, where the servers try to negotiate a TLS connection with other servers but resort to unencrypted e-mail if they cannot; or enforced TLS, where your e-mail servers use only TLS and refuse to talk to another company's e-mail servers if they do not support the protocol. After resolving those problems, we hit on e-mail routing issues, Routing is based on the use of mail exchange records, which specify the e-mail servers that should be used for a particular domain.

The article discusses the two computer security problems which threaten the entire Internet. The easy one to fix is in Cisco routers and switches; Cisco has a patch that blocks the problem. The other vulnerability is with the Transmission Control Protocol (TCP), the TCP in TCP/IP. Put simply, the TCP vulnerability makes it possible for an attacker to shut down a TCP session after guessing a random number. It could be used to shut down communication between two routers on an Internet backbone. That, in turn, could knock out whole chunks of the Internet until the routers recover and rebuild their routing tables. There are several fixes for this such as IPsec, RFC 1948, and RFC 2385. Some use encryption. But they all require trade-offs. With regards to the TCP flaw, the Internet backbone is largely at risk because the routers running it don't have the computing power to run encryption-based protocols like IPsec, which could block not only number-guessing attacks but many other threats as well. The authors says that what it would take to roll in faster hardware for all of the Internet's backbone routers is just money. The author concludes that if money is not appropriated for this problem, then there's no one else to blame when some number-guessing attacker brings down the Internet.

Presents an article about the complexities of managing patch and virus signature update compliance. Subscription to various automated advisory services and Web sites; Configuration of access-control lists; Vulnerability of the Solaris 9 file transfer protocol server software.

Presents updates related to computer security as of September 1, 2003. "Real 802.11 Security: Wi-Fi Protected Access and 802.11i," by John Edney and William A. Arbaugh; Upgrade made by NCipher PLC on its line of hardware-based cryptographic key management products.

Presents an article about two computer security incidents both involving deleted files on servers. Configuration of file transfer protocol server; Problem with security incidents in a large enterprise; Development of an incident reporting program.

Announces that U.S. national cybersecurity chief Richard Clarke sought additional funding for independent research aimed at improving the security and reliability of Internet protocols. Systems that could be sources of intentional or malicious acts; Technology developed by Packet Design LLC.

Reports on recommendations and specifications for greater security from the Institute for Electrical and Electronics Engineers' Task Force I in response to 802.11 wireless local area network vulnerabilities. First recommendation; Only major operating system vendor supporting 802.1x; Major issue with Advanced Encryption Standard.

Features Sun Microsystems Computer Corp.'s Simple Key Management for IP (SKIP) protocol support, the most significant enhancement of Novell Inc.'s BorderManager family of security solutions. Absence of connection setup overhead; Capability of failed encryption gateways to reboot and resume decrypting packets instantly; Access security to the corporate network; Scalable multicast key distribution.

Focuses on the teamup of Hewlett-Packard Co. and Cylink Corp. to provide a greater level of security of in the JetSend protocol. Application of the protocol for device-to-device communications via the Internet; Basic component of the JetSend appliance-development kit.