Poor privacy impact assessments

The San Francisco Chronicle reports that Americans are having immigration problems going to Canada based on very old criminal offenses. This is because of Canadian law that bars certain individuals from entering the country. The law hasn't changed, but the information available to the border guard has changed. The article states:

So it isn't as if rules have stiffened. But what has changed is the way the information is gathered. In the wake of 9/11, Canada and the United States formed a partnership that has dramatically increased what Lesperance calls "the data mining'' system at the border.

Read more


File this under 'gee isn't that obvious'

Apparently it really does take a study of the US military and Carnegie Mellon's CERT to understand that there is a link between disgruntled employees and IT sabotage. The story notes:

Nearly all the cases of cybercrime investigated were carried out by people who were "disgruntled, paranoid, generally show up late, argue with colleagues, and generally perform poorly."

They produced a study and model of which employees were most likely to commit sabotage. Security management vendor's claimed the solution is password management, which I wouldn't deny is part of the solution, but is it really that hard to spot a disgruntled employee? What if they put in a backdoor that you don't even know about? That password isn't going to do much good. And if any of my colleagues disagree with my viewpoint, perhaps they should be examined more closely for insidious intent as the vendor also noted:

Read more


The death of DRM? I doubt it

There's been a lot written about the deficiencies of DRM over the last couple of days, with some justification too. Recent efforts have been pretty shoddy, with very little effort devoted to allowing content creators to get true credit for their work and more to serve corporate interests. There's some pretty complex political wranglings to sort out here, between the content providers and hardware and software manufacturers. Does this mean the end of DRM? I doubt it.

Read more


From RSA to 2007 and beyond

The Forrester security team: Jen Albornoz Mulligan, Natalie Lambert, Laura Koetzle, Christopher McClean, Jonathan Penn, Paul Stamp, and Chenxi Wang attended this year's RSA. Among the 7 of us, we probably talked to 90% of the companies represented at the conference (if not more).  Collectively, here is our team's takeaway and outlook for 2007 and beyond:

1. Lots of service plays and blended software/service offerings (we predicted this trend before the conference). Software as a service seems to be maturing in the security world, particularly in the content filtering and SIM spaces.

2. More big players are getting into the security business. Oracle had a booth at RSA! Smaller vendors seem to target more at potential acquirers or VC funding rather than customers, which means M&A activities will remain high (We also predicted this in our pre-conference poll, see our Feb 5th blog entry: RSA trends). Increasingly, security will be a market made up of big businesses.

Read more

Mini Y2K all over again

When congress changed the daylight savings time standard, we saw the fragility of our computer infrastructure once more. It's the Y2K problem all over again, granted on a much smaller scale as time will only be off by an hour, not a century. Several of our clients have asked about this issue, as well. So I pose this question to you, blog readers! What are you doing about this time change? Do you think it will cause problems for your organization? Are the vendors responding quickly enough? How do you handle custom applications?

RSA Highlights

It's the end of a long week out in rainy San Francisco at the RSA Conference, but it's been a great trip. I met tons of people, attended lots of sessions, and learned about new vendors' products. My highlights in no particular order:

Read more

Trends at this year's RSA

Hi everyone. This post is from Chenxi Wang, your new security analyst :-). I've been with Forrester for an entire week! I polled a few senior folks in the industry to get their opinion on this year's top trends at RSA. Here is the feedback (it was difficult to derive consensus, so I compiled the top four responses.) They are listed in the Letterman fashion, from #4 to #1, [Drum rolls...]: 

#4: A raft of identity management solutions brings a renewed focus on identity management. Federated identity will continue to languish.

#3:  There will be lots of services plays (be they software as a service, MSSP, or proserv of various sorts).

#2. Everything will be about endpoint security, particularly mobile devices. However, there are a lot of impending mergers and acquisitions. Also, this year we should see aggressively priced imported components from Asia that create price pressure.

And the #1 trend in RSA 2007 is...

#1: There are a lot of conversations on risk management but little consensus on what RM really means.

People who participated in this poll:

Becky Bace: Venture consultant, Trident Capital

Read more

Computerworld on Vista

I read this article from Computerworld by Scot Finnie this morning about Vista. It's an interesting discussion of his belief of Microsoft's priorities with Vista (avoiding negative publicity, and enterprise customer focus). I think he makes a lot of great points but there's one area that I do think he's giving Microsoft the short stick. I quote:

Now that Vista has shipped and my review work is finished, I'll admit it: I turn off UAC on my machines. But here's the most important point: I've never even looked to find the off button for a similar feature on the Macintosh. Why? Because Apple smartly reserved the prompts for the most dangerous things, not everything.

Read more

Five things you didn't know about: Jen Albornoz Mulligan

One of our fabulous RAs Alissa Dill suggested that I should follow in the steps of the Forrester Marketing Blog and do a "Five things you don't know about me" post. What you probably already know is that I'm a researcher on the security and risk management team focusing on privacy, server operating system security, RFID security and web application firewalls.

I'd also like to mention some of my upcoming traveling.I will be at the RSA conference next week in San Fran if you'd like to meet, and I also plan to attend the IAPP Privacy conference in DC in the first week of March. Feel free to drop me a line jmulligan@forrester.com.

On to the five things you don't know about me:

Read more