Posts Tagged ‘security’

IDC Finds the APEJ Security Software Market Grew as Organizations Favor a Holistic Approach to Address Security Threats

February 9th, 2012

There has been a keen competition between malware and security software. Therefore, the investments on security research and software development will never decelerate. According to the latest IDC Asia/Pacific Semiannual Security Software Tracker, all the security software functional markets registered a double-digit year-on-year (YoY) growth in the first half of 2011. The security software market grew 18.5% over 1H 2010 to US$796 million in 1H 2011. As security threats are getting more severe and complex, the overall security software market is forecasted to grow 17.5% to US$1.674 billion in 2011 compared to 2010.

Identity and Access Management (IAM) achieved the highest YoY growth rate of 32%, while the Secure Content and Threat Management (SCTM), Security and Vulnerability Management (SVM), and Other Security Softwares reached a YoY growth rate of 16.4%, 14.2% and 21% respectively.

“We can see vendors applying their cloud computing technology to their security infrastructure including integrating the cloud based security functions into their products. It has become the mainstream of the secure content and threat management. Traditional client based virus library security scanning has become a heavy burden in terms of IT resources consumption, not to mention that it is incapable of handling the latest virus or threat evolution, like zero day malware. As resource sharing and optimization are the major objectives under the highway of universal virtualization, the adoption rate of cloud based security infrastructure, which can offer a light-weighted instantly-updated global virus library, will continue to grow and extend into all the security functional markets,” says Marco Lam, Market Analyst of IDC Asia/Pacific Software Research.

Cyber crimes and cyber threats in the IT world are becoming more well organized and efficient. Nowadays invasion could be embedded in a botnet, which could seed virus and Trojan into the linked server or station without waking up the security alarm. It could also be an embodiment of a link in social media or email. Infected computers, or newly formed “bots”, can then be used to steal passwords and record keystrokes, while concealing the attacker’s identity. Or even to stir up a ’denial of service attack’ to the public utility or stock exchange market. The financial lost can be huge and it is becoming a huge threat to the public utility.

Although Identity and Access Management is still in the development stage, IDC foresees its role to become more crucial in the future IT environment. As virtualization and mobile devices are gaining popularity against the traditional client work station and server, identity protection is becoming the prerequisite requirement for communication across the boundaries.

More loopholes are going to be found in popular smart phone and surging tablet applications arena. This will present a severe challenge and threat to the business environment. These new threats will compel IT management to regulate the use of applications on personal devices within corporation networks, as security threats embedded within an application can bypass most of the security gateways if it is run after entering the company network. This will evolve into different form of compromises like insider sabotages, identity fraud, breaches of insecure networks, unauthorized access to corporate systems, networks, and confidential information.

“Security threats are becoming more tenacious and organized. As we rely more and more on IT technology in our daily life, IDC expects companies to continue to invest and install the latest detecting and defending tools to protect their assets. Thus, the overall security software market will continue to experience a decent growth despite the signs of economic slowdown,” Marco concludes.

Source:http://www.nationmultimedia.com/technology/IDC-Finds-the-APEJ-Security-Software-Market-Grew-a-30175480.html

MetaFlows launches low-cost SaaS product that unifies network security

January 31st, 2012

Network security monitoring startup MetaFlows launched a new Software-as-a-Service (SaaS) product that can be installed on low-cost hardware to monitor network traffic flow, detect possible intrusions and analyze event logs.

The MetaFlows Security System (MSS) is composed of local software agents that can run on inexpensive off-the-shelf hardware and a cloud-based service where the results are stored.

The local MSS sensors capture network events and transmit the corresponding data to the company’s cloud system where they get analyzed and sorted by priority. Customers can inspect the results using a secure Web interface.

The sensors can be deployed as stand-alone appliances or they can be installed on the customer’s existing hardware using a Linux-based software package that contains proprietary and open source technology.

The software agent includes BotHunter, an IDS (intrusion detection system) software licensed from SRI International; the open source Snort IDS with generic signatures from the Emerging Threats project; the Flow, NetFlow, Sflow and CFlow network traffic monitoring plug-ins; log management tools compatible with OSSEC (Open Source Security) and MetaFlows proprietary applications.

The company also offers a package for setting up a honeypot client that acts as a decoy for internal network threats, although this is an optional feature.

One of MSS’ key benefits is the low cost associated with its deployment and maintenance when compared to traditional IDS products, said MetaFlows CEO Livio Ricciulli.

This is partly due to the use of open source software, but also because of improvements made to it by MetaFlows. One example is the modifications made by the company to the PF_RING packet capture library in order to support multithreaded Snort instances on multi-core processors.

This allows MetaFlows sensors to process 800M bps of sustained network throughput when using an eight-core Intel i7 CPU that costs around $1,000. In comparison, the max throughput that can be processed using a standard packet capture library with a single thread is 100M bps.

On the server side, the company has developed a threat prediction algorithm similar to the one used by Google’s search engine to rank websites. This technology is used to prioritize events, therefore increasing the productivity of network security analysts.

According to Ricciulli, tests performed by the company showed that with a traditional IDS solution, an analyst has to inspect between 20 and 30 incidents before finding one that requires an action. However, because MetaFlows’ predictive algorithm uses anonymous statistics from all customers to determine the most serious events, an analyst will have to inspect only six or seven incidents in order to find an actionable one.

The nature of the platform, which allows data from sensors deployed in multiple computer networks of the same organization to be gathered and inspected in a single place, facilitates better collaboration between analysts.

The cost of a low-end IDS appliance is $20,000, Ricciulli said. The subscription for the service is $4,000 per year and the money spent by a company to pay an administrator for it is around $80,000 per year. In comparison, an MetaFlows appliance costs $2,000, the subscription is $99 per month and the administrator’s salary is estimated at $50,000.

MetaFlows is based in San Diego. The company has received research funding from the U.S. Department of Defense and the National Science Foundation.

Source:http://www.computerworld.com/s/article/9223828/MetaFlows_launches_low_cost_SaaS_product_that_unifies_network_security

How We Test Antivirus Software and Security Suites

January 31st, 2012

At PCWorld, we take security seriously. That’s why we don’t skimp when it comes to testing security suites and antivirus software to see which ones will keep you safe. We work closely with experts in the security testing field, who put every antivirus product we review through a veritable torture test. Here’s a quick rundown of how we review and rank security products, and how we weight each aspect.
Malware Detection, Blocking, and Removal

60 percent of the overall score

To ensure that we have the most accurate and relevant malware detection, blocking, and removal test results, PCWorld teams up with AV-Test, a respected security-software testing lab based in Germany. AV-Test examines how well security software defends a PC against new and existing malware, along with how well the software cleans infections should malware make it onto the PC.

AV-Test evaluates security software through the following tests.

Blocking of real-world attacks: In this portion, AV-Test pits each software package against actual, live malware samples, and determines whether the software can fully or partially block each malware attack. This test is a good indicator of how capable a security suite or antivirus package will be at blocking brand-new malware.

Malware “zoo”: In the malware “zoo” test, each security product faces a collection of thousands of malware samples from the past four months. This test is a good indicator of how well a security product will be able to block known malware.

False positives: False positives can be just as frustrating to deal with as malware infections. AV-Test checks to see whether a security software product mistakenly flags any known safe files as being potentially dangerous.

System disinfection/remediation: Stopping malware before it reaches your PC is only half the battle. Cleaning an active malware infection is the other half. This test determines how well antitivirus software can detect, disable, and fully purge active malware infections on a test PC.
Speed Tests

20 percent of the overall score

System performance impact: Some security products–especially suites–can seriously hamper your PC’s performance. AV-Test runs each product through a battery of tests to discover whether it significantly slows common PC tasks, such as starting up and shutting down the machine, copying and downloading files, opening files, installing software, and opening Web pages.

Scan speed tests: The scan speed tests show how quickly a suite can check 4.5GB of data for malware. In this portion of the evaluation, AV-Test checks the performance of both the “on-demand” scanner (which runs when you manually initiate a scan) and the “on-access” scanner (which runs whenever you open or save files to disk). In general, the on-access scan performance is more important than the on-demand scan performance, since on-access scans kick in every time you open or save a file on your computer.
Design and Usability

15 percent of the overall score

Once AV-Test has completed its portion of the evaluation, we take each product we review out for a test drive to see how easy it is to use. For this portion, we base our assessment on time-limited trial versions of each product, or on evaluation copies provided by the vendor.

We take into account each product’s installation/uninstallation process, its main control panel and settings screens, its documentation, and more. Since the most important part of a security product is how well it protects your PC, we don’t place a whole lot of weight on usability, but a poor interface can definitely hurt a product’s overall score.
Specs

5 percent of the overall score

Finally, we look at each product’s specifications to determine whether it has a number of common features, and how each company’s support options stack up.

Source:http://www.pcworld.com/article/248974/how_we_test_antivirus_software_and_security_suites.html

Don’t use our software, security firm Symantec warns customers

January 27th, 2012

Symantec is advising customers to disable one of its products, after hackers revealed the theft of the underlying code powering the software earlier this month.

The security firm said the theft occurred in 2006, compromising 2006-era version of Norton Antivirus Corporate Edition, Norton Internet Security and Norton SystemWorks. More important was the theft of the code behind the remote access package pcAnywhere, which could allow malicious users to gain complete access to systems and data, experts warn.

“Symantec recommends disabling the product until Symantec releases a final set of software updates that resolve currently known vulnerability risks,” the company wrote in an online statement about the hacking.

The new advice is a marked change from earlier comments from the company, which at first downplayed the significance of the hacking, said Ira Victor, a security expert with Data Clone Labs in Nevada.

“At first, Symantec said that customers do not need to take additional actions in light of the breach,” Victor told FoxNews.com. “Now Symantec has changed their tune.”

Indeed, experts queried by FoxNews.com in January labeled the incident more of a business risk than anything else — one that may lead to a loss of confidence in Symantec and potential loss of market share for the publicly traded firm.

“The headline is very embarrassing to Symantec,” Anup Ghosh, founder and CEO of Virginian security firm Invincea, told FoxNews.com at the time. “But this has now become the normal in securities. Every single corporation is susceptible to threats.”

The company’s new advice suggests the security breach may have been more significant than Symantec had believed at first.

“It’s possible that Symantec ‘hardcoded’ encryption keys into PCAnywhere,” Victor said. “If true, that would be a serious security mis-step.”

In the newly released security advisory, Symantec offers suggestions for tightening security in light of the code theft. Victor suggests four additional steps to greater protection:

1. Do not use a “suite” of security protection from any one firm. A mixture of best of breed security is more secure.

2. Usernames and passwords alone are not enough protection for remote access. A single-use password system makes unauthorized remote access exponentially harder for cybercriminals.

3. Do not run computers in “Administrator” mode. Run systems in “User mode” so that malware does not install automatically.

4. Businesses should deploy application “whitelisting.” This will prevent unauthorized malware from running on computers.

Source:http://www.foxnews.com/scitech/2012/01/26/dont-use-our-product-symantec-warns-customers/

Norton Security hacked, experts suggest using other anti-virus software

January 19th, 2012

The parent company of Norton Security is admitting that hackers have stolen its security source codes.

The source codes contain the top secret keys as to how the anti-virus software works.

The theft of the source codes actually occurred in 2006 but computer experts say cyber-criminals can still find them useful.

One expert believes that it is possible the hackers have been using the source codes for years and are now just beginning to share them with the cyber-criminals.

Calls to Norton Security were not answered.

Source:http://www.kmov.com/news/technology/Norton-Security-hacked-experts-suggest-using-other-anti-virus-software-137633918.html

McAfee Mobile Security Software Available on New Lenovo ThinkPad Tablet

January 17th, 2012

McAfee today announced that McAfee Mobile Security software will be preloaded on Lenovo’s Android-based ThinkPad Tablet for business users. McAfee Mobile Security software will be available as a 30-day trial. This move extends McAfee’s ongoing collaboration with Lenovo to safeguard both the device and its stored information.

“The tremendous popularity of mobile devices and their subsequent adoption in the workplace means IT organizations must worry about data-compromising malware as well as the danger of lost and stolen devices,” said John Thode, executive vice president and general manager, consumer, small business and mobile, McAfee. “As these devices store increasing amounts of personal and corporate data, they need to be secured to avoid potentially damaging data breaches, network intrusions or hacker attacks.”

“Today, more companies and employees are using mobile technology devices – both at home and in the workplace, and we built our ThinkPad Tablet with this in mind,” said Tom Butler, director, ThinkPad Business Unit, Lenovo. “McAfee Mobile Security provides the comprehensive set of security features users need to protect their personal information stored on tablet devices, as well as to provide safeguards for business data.”

McAfee® Mobile Security software is a powerful combination of McAfee® VirusScan® Mobile software, McAfee® WaveSecure™ software and McAfee® SiteAdvisor™ for Android software. The solution protects a mobile device if it’s lost or stolen; safeguards against mobile viruses and spyware; and allows users to safely surf the Web. Users can recover lost devices with alarm and location tracking, prevent misuse with remote lock and wipe and preserve important memories and personal data with remote backup and restore options. At the same time, McAfee Mobile Security protects against the risk of malware that originates via email, instant messaging and Internet downloads.

Source:http://www.businesswire.com/news/home/20120116005009/en/McAfee-Mobile-Security-Software-Lenovo-ThinkPad-Tablet

Panda Updates Cloud-based Security Software

January 3rd, 2012

A software company has released a free beta version of its cloud-based security application that includes protection against malware loaded onto external devices, such as USB flash drives. Version 6.0 of Panda Security’s Panda Cloud Office Protection is a cloud-based service for protecting PCs, servers, and laptops. They can be managed remotely through a Web-based console.

The device control technologies within the new release allow the security administrator to control how computers will respond to external devices such as thumb drives, DVDs, and digital cameras: by denying access, forcing read-only access, or granting full access.

The new version resides on Windows Azure, Microsoft’s enterprise-grade cloud services platform.

Panda Cloud Office Protection is intended to provide cloud-based endpoint protection of files, email, HTTP/FTP downloads, and instant messaging against viruses and other cyber threats. It handles updates automatically and includes a personal firewall that’s centrally or locally managed. The administrator can use a Web console to resolve security issues and access malware audits and reports. Installation onto user devices can be handled through emails with download URLs; via distribution through login scripts, Active Directory, Tivoli, SMS, or Lan Desk; and locally, by having the user download an installer from the console.

The cloud based version of Panda’s security software is currently in use by 160 schools for 11,000 computers in the Cheshire district in England, including 700 computers at Sir William Stanier Community School.

The beta of version 6.0 can be downloaded for free at the Panda Security Web site. The company said it will reward the most active beta users with Amazon coupons.

Source:http://thejournal.com/articles/2012/01/03/panda-updates-cloud-based-security-software.aspx

Get Adobe Flash playerPlugin by wpburn.com wordpress themes