Forget About Security's Impact On Business -- What About Business' Impact On Security?

These days, it’s not just modern-day Willie Suttons behind cyber-attacks. While financial motivations still drive the mindset of most hackers, we’re seeing a renaissance of high profile attacks perpetrated for political and ideological purposes. Hactivism isn’t new, but combined with the rising likelihood of success and the greater damage
from successful attacks, we should expect to see it more often.

What it means:

Just as security decisions have a business impact, we are now seeing business decisions have a security impact. Some organizations will always be a target: governments, banks, and as we’ve recently seen NGOs like the IMF. But other organizations step into the line of fire: Anonymous attacked PayPal, MasterCard, and others because of their actions against WikiLeaks and Assange, while Sony’s legal actions against George Hotz (for jailbreaking the PS3) led to the spate of LulzSec attacks against it.

Read more

Participating In Markets For Portable Identities In The Cloud: What’s The Coin Of Your Realm?

Many IT security pros are moving toward disruptive new authentication and authorization practices to integrate securely with cloud apps at scale. If you’re considering such a move yourself, check out my new report, The “Venn” of Federated Identity. It describes the potential cost, risk, efficiency, and agility benefits when users can travel around to different apps, reusing the same identity for login.

Aggregate sources of identities are large enough now to attract significant relying-party application “customers” – but the common currency for identity data exchange varies depending on whether the source is an enterprise representing its (current or even former) workforce, a large Web player representing millions of users, or other types of identity providers. These days, the SAML, OAuth, and OpenID technologies are the hard currencies you’ll need to use when you participate in these identity markets. You can use this report to start matching what’s out there to your business scenarios, so you can get going with confidence.

RSA Breach: Two-Factor Authentication Is Not Dead But Is Morphing And Getting More Granular

Many IT end-user companies deployed hard tokens at a time when intermediate-risk choices were thinner on the ground, and some of these companies would have benefited from a more granular approach anyway. In general, we are seeing companies moving towards risk-based authentication augmented by mobile soft tokens (sometimes called from a mobile application through an API). These software-only solutions are easier and cheaper to deploy, particularly if the target population is on smartphones, and a lot easier to patch in case of an attack. Interestingly, risk-based authentication is now asked about not only in the B2C context (which was a norm about a year ago), but also in the B2E context as well. Right now, end-user companies are thinking about:

  1. How they can ditch hardware tokens altogether; and
  2. How can they can move risk-based authentication, and increasingly authorization (fraud management), into the cloud.

The Power Of Data Analysis - "Spamalytics"

Some of you may have seen the article in the New York Times by John Markoff (endnote1) announcing a paper to be presented at last week’s IEEE conference. This paper is an update to research conducted by a team at the International Computer Science Institute in Berkeley, California. The institute is associated with the University of California, San Diego and the University of California, Berkeley. A paper published by the team in 2008 Spamalytics: An Empirical Analysis of Spam Marketing Conversion outlines interesting research in the area the research team has coined as “spamalytics.”

The paper describes a methodology to understand the architecture of a spam campaign and how a spam message converts into a financial transaction. The team looks at the “conversion rate” or the probability an unsolicited email will create a sale. The team uses a parasitic infiltration of an existing botnet infrastructure to analyze two spam campaigns: one designed to propagate a malware Trojan, the other marketing online pharmaceuticals. The team looked at nearly a half billion spam emails to identify:

  • the number of spam emails successfully delivered
  • the number of spam emails successfully delivered through popular anti-spam filters
  • the number of spam emails that elicit user visits to the advertised sites
  • the number of “sales” and “infections” produced
Read more