Considering all of the nasty worms, viruses and security breaches that have wreaked havoc on server rooms this past month, next week’s RSA Security Conference could not come at a better time.
The 13th annual event in San Francisco is fast becoming a place where security forces in the computer industry come together with their government counterparts to present a unified front on information security and infrastructure protection.
Bill Gates, Microsoft chairman and chief software architect, opens the conference and should have the most to talk about. In the last 30 days, his Redmond, Wash., software giant has suffered not only vicious denial of service attacks
Most recently, a component of the Microsoft Windows ASN.1 vulnerability is circulating, prompting security experts to issue a chilling warning: a Blaster-type virus attack is imminent.
MyDoom and its variants caused some $39 billion in economic damage thus far, according to security firm mi2g. This estimate marks the highest financial damage from any “malware,” impacting overtime payments, contingency outsourcing, loss of business, bandwidth clogging, productivity losses, management time reallocation, cost of recovery and software upgrades.
“A virus attack will happen and it will happen very soon. It’s not a matter of if, but when,” warned Gartner security analyst John Pescatore. “This is a very dangerous vulnerability. It is pretty easy to exploit and once the bad guys get their hands on an exploit, we will see an attack.”
The Linux community has not been immune to security problems either. Researchers this week warned of potentially serious vulnerabilities in the kernel that could allow malicious hackers to gain full super-user privileges. The vulnerability affects the 2.6.x branch prior to version 2.6.3 and the Linux kernel memory management code.
“It’s sort of like a pack of dogs nipping at your heels when you’re waiting for the big pit bull to come and bite you,” Chris Belthoff, a senior analyst at Lynnfield, Mass.-based Sophos, an anti-virus and anti-spam company.
While encompassing all aspects of protecting the country, the Department of Homeland Security (DHS) has placed a particular emphasis on the telecom infrastructure and has even stepped in to take over the management of the National Communications System from the Department of Defense. The system coordinates emergency preparedness for the U.S. telecom sector.
Seeing a need to show that the government is acting, conference organizers Friday announced that several members of the DHS will join the conversations about how to fight Internet attacks. Scheduled to appear are: General John Gordon, assistant to the President for Homeland Security; Dr. Penrose Albright, assistant secretary for science and technology, U.S. Department of Homeland Security (DHS); and Amit Yoran, director of the National Cyber Security Division, DHS.
In addition, 11 vendors are teaming with the U.S. General Service Administration E-Gov E-Authentication Initiative to demonstrate interoperability of the Security Assertion Markup Language (SAML). The group, spearheaded by OASIS
The group said this would be the first time that members of the OASIS Security Services Technical Committee will demonstrate both types of SAML version 1.1 Single Sign-On, along with additional scenarios that highlight SAML’s flexibility.
But despite the extra wave of patches, firewalls and security measures, there still does not seem to be one solution that would serve as a panacea for protecting corporate data.
“No network can be made 100 percent secure, however, companies must
develop a comprehensive security plan spelling out areas to be secured and
where potential threats lie,” Lynda Starr, Probe Group vice president said
in a recently published report on security. “Good security practices can’t
always prevent an attack, but they can minimize the damage.”
