An information security crisis is the moment when you improvise (06/04/2007)
(...) It was, and will always be, a threat that is surprisingly hard to define. Almost by definition, terrorism will continually seek to change its face. But enough has already been written on this subject and before we also slide towards overindulging our concern with just one type of threat, let us return to the subject of this article: can you really handle any crisis? In March 2000, a lightening bolt caused a blaze at a Philips electronic factory in Albuquerque in the United States. (...)

The business case for information security (06/03/2007)
(...) Virus attacks were still the most frequently occurring incidents, with 1612 incidents taking place during the last 12 months alone.1 In the FBI/CSI 2002 survey  85 per cent of organisations surveyed had experienced viruses;  55 per cent had experienced laptop thefts;  40 per cent has experienced a denial of service attack. Before making direct comparisons we need to take into account the differences in sample populations. (...)

The demand for continuous information (06/03/2007)
(...) The key findings reinforce the growing supremacy of technology in facilitating this interaction, and the ongoing difficulties faced by businesses in measuring costs.  Of those surveyed, 94 per cent of businesses said that their customers now use call centres to contact them, with 88 per cent of those questioned using email and 66 per cent also using the Internet. This compares with more traditional methods, where only 43 per cent of customers still use branch networks. (...)

The threat from cybercrime (06/03/2007)
(...) The Department of Trade and Industry (DTI) Report1 of April 2002 reveals that key UK government departments face an average of 84 hacking attempts a week. 1.3 1Information Security Breaches Survey 2002, DTI. (...)

Recent attack trends (06/03/2007)
(...) Trend 4: Increasing permeability of firewalls Firewalls are often relied upon to provide primary protection from intruders. However, technologies such as IPP (Internet Printing Protocol) and WebDAV (Web-based Distributed Authoring and Versioning), as well as certain protocols marketed as being firewall-friendly, are designed to bypass typical firewall configurations. Trend 5: Increasingly asymmetric threat Security on the Internet is, by its very nature, highly interdependent. (...)

Recognising the enemy within (06/03/2007)
(...) The next candidates in this category are under-utilised employees who find themselves with time on their hands during the working day in which to experiment and investigate. For whatever reason, at a given moment in time they are not the best friends of the company. The careless employee is the one that leaves their password written on a piece of paper in the top drawer of their desk, or who walks away from a terminal leaving it connected to a valuable data source. (...)

Cyberliabilities in the workplace (06/03/2007)
(...) Employers may risk being vicariously liable for defamatory material communicated by email. In a high profile case of recent years, incorrect rumours concerning a rival insurance company were circulated on Norwich Union’s internal email system, with the result that Norwich Union paid out nearly half a million pounds in a court settlement to the rival company. As email is so quick and easy, there is an increased risk that employees may unwittingly enter into contracts that bind their employers. (...)

Data complacency (06/03/2007)
(...) It is this unchallenged availability and the ease with which it can be circulated by an employee with an email connection that is presenting a security risk that has so far largely gone unnoticed. In most cases the circulation of sensitive data, perhaps a sales forecast or share price information, is not conducted maliciously. Instead it is carried out by the growing army of employees to whom email is second nature, who perhaps don’t assign as much importance to a piece of data as their contemporaries would have done ten years ago. (...)

Cybercrime and The marketing dimension (06/03/2007)
(...) We feel that we ‘own’ our PC – even if our organisations actually paid for them – but unless proper measures are taken we may well be sharing ‘usership’ with others. Either they know everything that we do, or they use part of ‘our’ computer’s power for their purposes; or they come in and alter our information, or are totally destructive, or act ‘merely’ as vandals. Suddenly the marketing manager is looking rather vulnerable, because his/her organisation is vulnerable, and the fallout will be lack of trust and reputation, which leads to brand problems. (...)

Information Security Management System (06/03/2007)
(...) The ‘mistake’ (or ‘I didn’t mean to destroy your livelihood’) Recently a ‘hactivist’ (someone who believes that their hacking is ‘ethical’ because they only break into sites and systems that are owned or run by organisations that they don’t agree with) destroyed a company that was totally innocent, even of the so-called ‘crime’ that the hactivist was so worked-up about. Unfortunately for the company its original founder had chosen a name that was similar to the name of a business that was connected with the use of animals for their fur – not the same name; not the target name; and the business certainly had nothing to do with the practice so hated by the hactivist. The company was totally innocent – and is now totally out of business. (...)

Online Security and Threats to email (06/03/2007)
(...) It is clear that the government needs to set out definite guidelines and regulations for the safe use of email. The events of 11 September 2001 brought new challenges to the protection of privacy in the modern age that led governments worldwide to extend control over individuals through the law and technology. It is unquestionable that email security is the next big IT security issue – a fact that gives rise to the following question: if a company’s most valuable asset apart from its workforce is its intellectual property, why are so many businesses failing to take the crucial steps towards protecting that property in its electronic form when it would be both simple and cost-effective for them to do so? Given the strictly monitored methods that are applied to the treatment of hard-copy letters and other documents, it is highly illogical for electronically transmitted information to be treated in the haphazard and insecure fashion that typifies common business practice regarding the use of email. (...)

Reducing the risks and eliminating the threats in our emails (06/03/2007)
(...) It protects confidentiality and confirms for the recipient that the message has arrived in its original state without having been seen by an unauthorised person. Good encryption software ensures that information is only decrypted as and when needed, and then makes provision for the safe deletion of electronic messages. This would have the same effect that a shredding machine has on paper that needs to be destroyed. (...)

How to be protected against viruses transmitted over networks (06/03/2007)
(...) Unlike the average Internet connection, these systems have network connections with large amounts of bandwidth. After an infection, a worm can use the bandwidth to spread itself to other web servers. Equally, the organisation operating the web server may base a large percentage of its revenue on traffic from its website, and the site outage could cause a largescale financial impact – not to mention the impact on customer confidence. (...)

Key security vocabulary explained (06/03/2007)
(...) It also has the ability to ‘drop’ the attack from the network to stop it from reaching its target. Trojan Horse: This is an attack that is hidden within a seemingly legitimate attachment to an email received across the Internet. Once inside a PC it infects memory, processor and applications, then spreads to other network resources. (...)

Protecting online privacy (06/03/2007)
(...) In particular the eight data protection principles in the Act must be complied with, namely: 1. Personal data shall be processed fairly and lawfully. 2. (...)

Secure Internet service (06/03/2007)
(...) Proseq services are available in the UK through partners such as Morse and Telenor Business Solutions UK. What do we do? In a nutshell, our partners either integrate our service to provide secure Internet services, or they provide unique security services with the required level of local support. We pride ourselves on having a round-the-clock operating centre with competence and vigilance to help and guide our customers through everything from small everyday incidents to serious attacks. (...)

Virus attacks (06/03/2007)
(...) By that time the damage can be impossible to undo as back-ups are corrupted as well. That said, if a company does fall foul of a virus that simply eliminates data, backups can often be used to restore the lost information. Clean-up costs Deciphering how much it costs an organisation to reinstate lost data, or to negate corruptions made by malicious code is an almost impossible task and depends greatly on the specifics of the virus in question. (...)

Authentication and encryption (06/03/2007)
(...) ‘Trojan horse’ computer viruses that steal passwords; competitors accessing seemingly protected databases using borrowed passwords of acquaintances; personal accounts being exposed to every member of a bank: none of these examples are just threats anymore; they are reality – and it’s not just sophisticated computer hackers who are causing the problems. Thrillseeking teenagers, novice computer programmers trying to make a name for themselves, and criminal organisations are all using password-cracking tools that are readily available on the Internet. As new e-business models become more complex and attackers develop more sophisticated tools, we can only expect the number of security breaches to increase. (...)

What are digital signatures (06/03/2007)
(...) In this process information is coded (encryption) to stop information from being read or altered by anyone but the intended recipient. It may be intercepted, but it will not be intelligible to someone without the ability to decode (decryption) the message. Encryption and decryption require both a mathematical formula (or ‘algorithm’) to convert data between readable and encoded formats and a key. (...)

Digital rights management (06/03/2007)
(...) Digital content is a broad term used to describe the wealth of information and products now available for consumption. From business and entertainment software, to video and Internet feeds, our society has never been so rich in information. The marketplace offers huge rewards to software pirates, from the casual copier to the dedicated hacker, particularly when the cost of a CD burner has fallen to less than C100. (...)