Hacking Takes Lead as Top Cause of Data Breaches
Posted using ShareThis
Sunday, February 21, 2010
Friday, February 19, 2010
Thursday, February 18, 2010
Simplifying Patch Management | IBM i | IBM Systems Magazine
Simplifying Patch Management | IBM i | IBM Systems Magazine
For patch and asset management of Windows servers and workstations SRC Secure Solutions is reseller of Shavlik NetChk Protect. Shavlik NetChk Protect is in use with more than 12.500 companies worldwide.
For patch and asset management of Windows servers and workstations SRC Secure Solutions is reseller of Shavlik NetChk Protect. Shavlik NetChk Protect is in use with more than 12.500 companies worldwide.
Monday, February 15, 2010
CMS zips up sensitive data for security in transit (source: GCN, Government Computer News)
DATA SECURITY
◦Jun 25, 2009
“We could send them encrypted [data], but the recipients might not have any way to decrypt it,” said Ray Pfeifer, senior technical adviser at CMS’ Office of the Chief Information Security Officer.
As a result, tapes full of data that other users needed were piling up at the data center. “I said there has to be a way to encrypt data on any type of media and provide a capability at the other end to decrypt it,” Boughn said.
CMS officials eventually settled on PKware’s SecureZIP PartnerLink for the task. The company does not provide an engine or algorithms for encrypting data, but it offers a platform for encrypting data and a virtual container in which to ship it.
“We do not consider ourselves an encryption company,” said George Haddix, PKware’s chairman and chief executive officer. “We deliver products that allow people to use encryption in managing their data. The Zip archive, I think, is an ideal container for data-centric security.”
PKware maintains the Zip data compression and archiving format, which works with most computing platforms. Many organizations have used it for years to transmit and store files. The Zip archive container includes metadata about the files so users can identify and individually retrieve them.
“We developed the concept about four years ago that this could be done in a secure manner by encrypting, signing or otherwise authenticating the files contained in the container,” Haddix said.
The company implemented the concept by extending the Zip archive definition to include the ability to use a strong password or pass phrase for access control and digital certificates for signing or encrypting the data being compressed.
The PartnerLink package requires customers to license the enterprise version of SecureZIP. Customer-sponsored partners can then download free software to decrypt and encrypt files using digital certificates that the customer provides. The 50 states are also preparing to send their data securely to CMS via PartnerLink.
SecureZIP can also be used with existing engines, and many mainframe customers, including CMS, use the hardware engines on their existing equipment’s co-processors.
“We’re taking advantage of that because it speeds things up,” Pfeifer said. The encryption engines are certified to meet Federal Information Processing Standard 140-2 for government encryption modules. CMS uses the Triple Data Encryption Standard.
Every year, the Centers for Medicare and Medicaid Services process about 1.25 billion Medicare claims, 1 billion prescription claims and 1 billion Medicaid files, along with claims for Children’s Health Insurance Programs — all on behalf of more than 90 million Americans.
“We’re a very large health insurer with a public health mission,” said Julie Boughn, director of the Office of Information Services and chief information officer at CMS. “We send and receive vast quantities of health care data.”
The data is not only voluminous but also a valuable public asset, she said. “Since we have so much of it, there is a lot of interest in using our information” for activities such as medical research and fraud investigations.
--------------------------------------------------------------------------------
In this report:
Sharing data with many partners requires a common encryption platform
--------------------------------------------------------------------------------
Some of the data is scrubbed of personally identifiable information and made available publicly for statistical purposes. Medical researchers often do not need to know the identity of the people whose information they are using, but some details are necessary to correlate data. On the other hand, law enforcement investigations typically require full information.
CMS has strict requirements for how partner organizations use data, and officials spell out the required levels of protection. But it is not enough for CMS’ partners to handle the data securely — CMS has to ensure that the information is secure while in transit.
That is not a simple task. The list of partners sending and receiving CMS information includes all 50 states and numerous health care providers and research institutions, each of which use different information technology systems.
When the Office of Management and Budget mandated that agencies secure data on mobile and portable devices in 2006, “we took that very seriously,” Boughn said. “We had already started down that path” by encrypting laptop PCs and using Pointsec to encrypt e-mail messages and data on USB drives.
As for data shared with partners, “I said I was not shipping any data out of our data center that is not encrypted,” Boughn said.
But that approach had unintended consequences. CMS is a mainframe shop, with IBM hardware that can encrypt data transferred to other media, such as the tape cartridges the agency sends to its partners. However, those recipients use everything from mainframes to servers and desktop PCs to access that data.
Another advantage of using SecureZIP to encrypt files for transit is that it also compresses the files by about 80 percent, an important consideration when dealing with the huge volumes of data CMS routinely sends. Using SecureZIP, a shipment of 25 tape cartridges can be compressed to five, Pfeifer said.
One issue recipients of encrypted data need to keep in mind is the format in which it will be used. Many recipients convert the mainframe data for use on other platforms, such as servers and desktop PCs. SecureZIP supports conversion from one format to another, “but you have to be aware you are doing the conversion of encrypted data at the other end,” Pfeifer said.
Overall, the tool is user-friendly, and customer support from PKware has been good, he said. “The time it takes for installation [ranges] from less than an hour for users of Windows to a few hours for a mainframe,” he added.
William Jackson is a senior writer for GCN and the author of the CyberEye column.
◦Jun 25, 2009
“We could send them encrypted [data], but the recipients might not have any way to decrypt it,” said Ray Pfeifer, senior technical adviser at CMS’ Office of the Chief Information Security Officer.
As a result, tapes full of data that other users needed were piling up at the data center. “I said there has to be a way to encrypt data on any type of media and provide a capability at the other end to decrypt it,” Boughn said.
CMS officials eventually settled on PKware’s SecureZIP PartnerLink for the task. The company does not provide an engine or algorithms for encrypting data, but it offers a platform for encrypting data and a virtual container in which to ship it.
“We do not consider ourselves an encryption company,” said George Haddix, PKware’s chairman and chief executive officer. “We deliver products that allow people to use encryption in managing their data. The Zip archive, I think, is an ideal container for data-centric security.”
PKware maintains the Zip data compression and archiving format, which works with most computing platforms. Many organizations have used it for years to transmit and store files. The Zip archive container includes metadata about the files so users can identify and individually retrieve them.
“We developed the concept about four years ago that this could be done in a secure manner by encrypting, signing or otherwise authenticating the files contained in the container,” Haddix said.
The company implemented the concept by extending the Zip archive definition to include the ability to use a strong password or pass phrase for access control and digital certificates for signing or encrypting the data being compressed.
The PartnerLink package requires customers to license the enterprise version of SecureZIP. Customer-sponsored partners can then download free software to decrypt and encrypt files using digital certificates that the customer provides. The 50 states are also preparing to send their data securely to CMS via PartnerLink.
SecureZIP can also be used with existing engines, and many mainframe customers, including CMS, use the hardware engines on their existing equipment’s co-processors.
“We’re taking advantage of that because it speeds things up,” Pfeifer said. The encryption engines are certified to meet Federal Information Processing Standard 140-2 for government encryption modules. CMS uses the Triple Data Encryption Standard.
Every year, the Centers for Medicare and Medicaid Services process about 1.25 billion Medicare claims, 1 billion prescription claims and 1 billion Medicaid files, along with claims for Children’s Health Insurance Programs — all on behalf of more than 90 million Americans.
“We’re a very large health insurer with a public health mission,” said Julie Boughn, director of the Office of Information Services and chief information officer at CMS. “We send and receive vast quantities of health care data.”
The data is not only voluminous but also a valuable public asset, she said. “Since we have so much of it, there is a lot of interest in using our information” for activities such as medical research and fraud investigations.
--------------------------------------------------------------------------------
In this report:
Sharing data with many partners requires a common encryption platform
--------------------------------------------------------------------------------
Some of the data is scrubbed of personally identifiable information and made available publicly for statistical purposes. Medical researchers often do not need to know the identity of the people whose information they are using, but some details are necessary to correlate data. On the other hand, law enforcement investigations typically require full information.
CMS has strict requirements for how partner organizations use data, and officials spell out the required levels of protection. But it is not enough for CMS’ partners to handle the data securely — CMS has to ensure that the information is secure while in transit.
That is not a simple task. The list of partners sending and receiving CMS information includes all 50 states and numerous health care providers and research institutions, each of which use different information technology systems.
When the Office of Management and Budget mandated that agencies secure data on mobile and portable devices in 2006, “we took that very seriously,” Boughn said. “We had already started down that path” by encrypting laptop PCs and using Pointsec to encrypt e-mail messages and data on USB drives.
As for data shared with partners, “I said I was not shipping any data out of our data center that is not encrypted,” Boughn said.
But that approach had unintended consequences. CMS is a mainframe shop, with IBM hardware that can encrypt data transferred to other media, such as the tape cartridges the agency sends to its partners. However, those recipients use everything from mainframes to servers and desktop PCs to access that data.
Another advantage of using SecureZIP to encrypt files for transit is that it also compresses the files by about 80 percent, an important consideration when dealing with the huge volumes of data CMS routinely sends. Using SecureZIP, a shipment of 25 tape cartridges can be compressed to five, Pfeifer said.
One issue recipients of encrypted data need to keep in mind is the format in which it will be used. Many recipients convert the mainframe data for use on other platforms, such as servers and desktop PCs. SecureZIP supports conversion from one format to another, “but you have to be aware you are doing the conversion of encrypted data at the other end,” Pfeifer said.
Overall, the tool is user-friendly, and customer support from PKware has been good, he said. “The time it takes for installation [ranges] from less than an hour for users of Windows to a few hours for a mainframe,” he added.
William Jackson is a senior writer for GCN and the author of the CyberEye column.
Monday, February 1, 2010
Cost of data breaches gets higher (source: www.fiercecio.com)
January 25, 2010 — 5:44pm ET | By Judi Hasson
A data breach is more than just a headache for an IT executive. It's likely to affect your bottom line in a big way. The Ponemon Institute's annual study of the cost of data breaches finds that these costs rose from $6.65 million in 2008 to $6.75 million in 2009.
Taken on a case-by-case basis, it doesn't sound like much. In 2009, data breach incidents costs U.S. companies $204 per compromised customer record compared to $202 in 2008.
It's not that simple. There are other factors, according to Ponemon, including loss of business, legal fees and the importance of a customer disclosing the breach to its own customers.
The most expensive data breach event in the 2009 survey cost one company nearly $31 million to resolve. The least expensive one was $750,000, the report said.
"In the five years we have conducted this study, we have continued to see an increase in the cost to businesses for suffering a data breach," said Dr. Larry Ponemon, chairman and founder of the Ponemon Institute. "With a variety of threat vectors to contend with, companies must proactively implement policies and technologies that mitigate the risk of facing a costly breach."
For companies trying to save money, that means you can pay now or pay later. You can spend money to secure your system or pay out when the system is breached. Neither is a very pleasant choice.
The year 2010 is not expected to be an exception to the increasing number of data breaches. This time around, experts say, it's imperative to protect your systems rather than hope you will avoid an attack.
For more on the Ponemon study:
- see this PCWorld.com article
- and see the complete study
Related Articles:
The 10 most terrifying IT debacles of 2009
Security breaches are no joke
Cybersecurity, cloud computing top IT spending list
The underpaid cybersecurity job
Read more: http://www.fiercecio.com/story/cost-data-breaches-gets-higher/2010-01-25?utm_medium=nl&utm_source=internal#ixzz0eHs2baHF
A data breach is more than just a headache for an IT executive. It's likely to affect your bottom line in a big way. The Ponemon Institute's annual study of the cost of data breaches finds that these costs rose from $6.65 million in 2008 to $6.75 million in 2009.
Taken on a case-by-case basis, it doesn't sound like much. In 2009, data breach incidents costs U.S. companies $204 per compromised customer record compared to $202 in 2008.
It's not that simple. There are other factors, according to Ponemon, including loss of business, legal fees and the importance of a customer disclosing the breach to its own customers.
The most expensive data breach event in the 2009 survey cost one company nearly $31 million to resolve. The least expensive one was $750,000, the report said.
"In the five years we have conducted this study, we have continued to see an increase in the cost to businesses for suffering a data breach," said Dr. Larry Ponemon, chairman and founder of the Ponemon Institute. "With a variety of threat vectors to contend with, companies must proactively implement policies and technologies that mitigate the risk of facing a costly breach."
For companies trying to save money, that means you can pay now or pay later. You can spend money to secure your system or pay out when the system is breached. Neither is a very pleasant choice.
The year 2010 is not expected to be an exception to the increasing number of data breaches. This time around, experts say, it's imperative to protect your systems rather than hope you will avoid an attack.
For more on the Ponemon study:
- see this PCWorld.com article
- and see the complete study
Related Articles:
The 10 most terrifying IT debacles of 2009
Security breaches are no joke
Cybersecurity, cloud computing top IT spending list
The underpaid cybersecurity job
Read more: http://www.fiercecio.com/story/cost-data-breaches-gets-higher/2010-01-25?utm_medium=nl&utm_source=internal#ixzz0eHs2baHF
Subscribe to:
Posts (Atom)