Linux Advisory Watch: April 4th 2005

Security in any enterprise should extend beyond just information technology to become an integral part of the organization's overall strategic plan. This concept is explored in great detail by the book, Mapping Security: The Corporate Security Sourcebook for Today's Global Economy. In this download of Chapter 3, Establishing Your Coordinates, authors Tom Patterson and Scott Gleeson Blue explain why organizations need to forget the traditional notions of risk. Enterprises should identify and measure weaknesses in all areas of the organization before starting any strategic planning. This download shows you where to look for weaknesses and how to begin that process.

Guardian Digital, Inc., a leader in open source security products, today announced the release of a new firewall product that will revolutionize internet security as we know it, forever.

Guardian Digital CEO Dave Wreski explains, "Our new product works differently from most other firewalls on the market, which can possibly allow dangerous packets into protected networks. Our technical wizards realized that all virus, worm, and malware authors use dangerous 'zeroes' in their binary code, therefore our new firewall product blocks all 'zeroes' while allowing the friendly, useful 'ones' through."

news/firewall/guardian-digital-announces-new-firewall-product

When embracing a defense-in-depth strategy for your organization's systems, setting up a secure network boundary and applying best business practices to your internal clients is a great start. But the work doesn't stop there. One area that organizations often overlook is application security for Web-enabled applications. In fact, some of the recent, highly publicized thefts of private information occurred due to poor application design and implementation.

Leading global telecommunications companies, ISPs, and network operators will begin sharing information on Internet attacks as members of a new group called the "Fingerprint Sharing Alliance," according to a published statement from the new group.

news/network-security/isps-join-to-fingerprint-internet-attacks

Network security specialist SmoothWall Limited, is today previewing its new Advanced Firewall, aimed at enterprise customers and organisations with demanding security requirements. Like its existing Corporate firewall for medium sized organisations, Advanced Firewall is based on open source technology, enabling SmoothWall to provide sophisticated enterprise class features at prices starting from £950.

news/network-security/smoothwall-launches-its-first-firewall-aimed-at-large-enterprises

IBM last week introduced technology called FairUCE, for Fair Use of Unsolicited Commercial E-mail, that blocks spam by trying to ID the sender's Internet domain rather than evaluating message content.

news/network-security/spammer-id-yourself

There is a classic moment during the battle for Helm’s Deep in the epic film, Lord of the Rings, the Two Towers, when King Theoden stands atop the supposedly impregnable city. Rain sodden, he surveys the massed ranks of Saruman’s armies and defiantly shouts ‘Is this all you’ve got?’ A few fateful minutes, and a well placed explosive, later his confidence is shattered and replaced with fear as he realises that his fortress has been penetrated.

Whilst this may have been a marvellous piece of celluloid drama, this scene could have been replicated in the IT departments of many enterprises throughout 2004. Replace Helm’s Deep with firewalls and the Orcs with trojans and viruses and you’ll soon appreciate the similarities.

news/network-security/the-demise-of-traditional-perimeter-defences

You may never think about it, but many of your online activities may be monitored and analyzed. Advertising companies, government agencies, and private users can use traffic analysis to gather information about which Web sites and pages you visit, what newsgroups you read, and whom you talk to on IRC. While there is no need to be paranoid (or is there???), you can keep your online communication private. The Tor project can help you with that.

news/network-security/securing-your-online-privacy-with-tor

The nightmare started when I returned to my office to discover 17 missed calls on my cell phone. A moment later, the phone rang again. A frantic customer complained of "eyes" on his Web site. I visit the site, and, lo and behold, discovered it proclaiming being "owned" by a hacking group. Upon further investigation, I discovered all the other Web sites on the Debian-based server had been defaced.

There are great open source products for nearly every purpose. But I have yet to find many in the security field. Most seem hand-written, based on books like the O’Reilly Secure Progrmaming Cookbook. Maybe I’m not looking hard enough. If I’m not, please point to your favorite open source security in TalkBack.

news/server-security/when-will-open-source-security-grow-up

How to fully utilise the resources at one’s disposal is one of the major dilemmas facing enterprises not only in the Middle East, but also around the globe. Increased efficiency results in costs savings and allows enterprises to focus attention to grander plans. Rashed AlOthman, senior vice president of IT services and control at Riyad Bank, has a simple mantra: The less complex a system an enterprise has, the fewer resources it is going to utilise.

The growth of the Indian security solutions market exceeded the expectations of most analysts last year. This momentum is expected to continue in 2005 as security war chests are expected to be opened wide this year. Analysts from Frost & Sullivan say that the growth of the network security market in India will exceed the projected growth rate of 32.4 percent in 2005. The IT and BPO industry will be the biggest consumers of security solutions.

Compliance requirements are fueling convergence between systems management and security markets, highlighted by several acquisitions over the last few years, experts said. Last Wednesday, Altiris agreed to acquire Pedestal Software for threat management for $65 million. BMC filled an important gap in an existing identity management product line by buying OpenNetwork for $18 million. Novell shored up its resource management and IT asset management suite by moving in on Tally Systems for an undisclosed sum.

Multinational companies invest a lot of money in IT security and increasingly expect smaller partners and suppliers to demonstrate the same level of commitment. IT security experts speaking at the RSA Security Conference last month predicted that large companies would in the future specify minimum security standards in contracts before doing business with their suppliers.

A consortium of companies focused on Voice over Internet Protocol (VoIP) Security is taking the first steps toward finding common ground in an emerging market and is boosting its presence by adding to the membership ranks.

Corporate executives love two words, “Due Diligence