RSA Conference kicks off on somber note

This week is the start of the RSA 2009 Conference in San Francisco. It's notable as one of the premier security tradeshows in the industry. Network World published an article today, stating it will feel smaller this year than in years past due to the current economy. As they state:

One telling sign of the times: RSA Conference is extending free passes worth more than $2,000 to 25 individuals described as "victims of corporate downsizing … who lost their jobs due to the economic environment."

If you're in the area, and you're interested in security, it's worth a visit to see the latest products. The show runs through Thursday at the Moscone Center in San Francisco.

McAfee slaps brand on Secure Computing products

For those of you keeping up on the acquisition news, McAfee's recent purchase of Secure Computing has finally moved down to the product lines. Some Secure partners were sent notice of it this past week, and informed of the changes in naming of the Secure products. SearchITChannel blogged about these changes:

So, say goodbye to IronMail and hello to McAfee Email Gateway.

So long Webwasher; hey to McAfee Web Gateway.

Sayonara to Sidewinder and howdy to McAfee Firewall Enterprise.

...

Securify morphs into McAfee User Behavior Analysis. SnapGear is now McAfee UTM Firewall. Secure Web SmartFilter is now just McAfee SmartFilter.

SearchITChannel's writer seemed a little concerned that something was being lost in the renaming, and the new names do seem to lose Secure's identity. But maybe that's the point, as they're now McAfee.

Web Filter Appliance Adds Feature To Protect Against Proxy Abuse

School Guardian, an SME and education focused Web filter appliance announced they have added a feature to help prevent proxy abuse, a significant problem in the K-12 market. We've talked about the use of anonymous proxies in previous posts here, and some of the solutions around it using features like real time rating of new websites/proxies. From The Journal:

School Guardian, in its latest version offers a feature known as SSL Interception, which helps to prevent students from using anonymous proxies such as Ultrasurf and Vtunnel.

These sites allow users to engage in online activities "anonymously," so that sites they visit and Web filters that monitor their activity will not know the Web address where the activity originates.

The current standard for blocking access such sites is to use "SSL certificate checking," which confirms the validity of a site's electronic certificate. However, advances in Web security technology have sparked corresponding advances in methods to undermine such technology, and today site content can be encrypted against filters, and obtaining an electronic certificate is easier than ever.

While SSL Interception has long been a feature of Enterprise proxies, this is a nice enhancement for the K-12 market.

The consequences of inadequate cloud security

We've talked about the move towards cloud computing in past blog articles, including concerns about lack of control of outages, and to a certain degree concerns around security. Network World brought up the security problem again this week in an article by Tim Greene. He accepts the premise that cloud computing can be beneficial to an organization's bottom line, but he states:

The downside is that businesses choosing to use cloud computing give up direct control of those corporate assets running in the cloud. Data and applications accessed through the cloud is in the cloud, not in a privately held corporate data center where the owner controls everything from the physical security to authentication and authorization to intrusion prevention to firewalling to virus protection.

The consequences of inadequate cloud security are great. The loss of corporate intellectual property is near the top of the list as is loss of corporate reputation should a breach result in public admission that sensitive personal data has been stolen.

For their part, cloud computing providers are aware of the risks and are making efforts to embrace security in a way that reassures their customers. Exactly what the standard should be for those efforts is evolving. So there is a lot to consider when developing strategies for how to use cloud computing and how to use it safely.

The question of whether to move to the cloud remains a tough one for IT administrators. Each will have to balance their needs for reduced costs with the amount of security and control they want to have.

How the Internet Got Its Rules

I came across this piece in the Op Ed section of the New York Times on the 40th anniversary of RFCs (Request for Comment). It's a delightful piece, authored by one of the early pioneers and a contributor to RFC 1. This intro should whet your appetite and convince you to read on by clicking the linked article from the title above.

When the R.F.C.’s were born, there wasn’t a World Wide Web. Even by the end of 1969, there was just a rudimentary network linking four computers at four research centers: the University of California, Los Angeles; the Stanford Research Institute; the University of California, Santa Barbara; and the University of Utah in Salt Lake City. The government financed the network and the hundred or fewer computer scientists who used it. It was such a small community that we all got to know one another.

Websense Launches New Appliance

Websense, a well known vendor in the web filtering space announced their first appliance this week, the V10000. Websense's URL filtering database has been available on a number of proxy servers, including Blue Coat's ProxySG as well as in a standalone software package available for Windows and Unix platforms.

Some insight on why Websense chose to go the appliance route from Channel Insider:

Websense, which recently completed a rebranding of the company, is trying to turn perceptions that it’s simply a Web filtering company that denies access to gross amounts of content and Websites to a technology provider that protects users without totally impeding Web access. The V10000 moves the company in that direction by providing security that strips or blocks malicious content from popular social networking sites—such as Facebook or Twitter—without impeding access or functionality.

The appliance, powered by two quad-core Intel Xeon processors and 16GB of DDR2 memory, sits at the gateway and provides application-layer inspection of all Web, peer-to-peer and instant messaging traffic. The appliance provides integrated Web proxy and cache management, giving users the ability to monitor and inspect SSL-encrypted traffic. Appliance management is through a Web-based console that enables granular policy configuration and compliance reporting.

The question here is whether Websense is too late to the game with a market that already has plenty of appliances, even ones that already run Websense software. A new product is always one that IT departments are wary of, so Websense's ability to succeed in a new market will remain to be seen.

Short-lived Web malware: Fading fad or future trend?

Security software vendor AVG Technologies announced that Web-based malware attacks are now so prevalent that attackers craft them to be "secretive, short-lived and fast-moving." This trend became more obvious this week with the Conflicker virus, which tried to access domains that did not even exist, causing domain registrars to scramble to block registrations of 50,000+ domains. Using a more sophisticated Web delivery mechanism that is short-lived helps to reduce the likelihood of attackers getting caught by antivirus signatures or heuristic checks.

From Tech Target's article on the same topic:

One of the best ways to counter newly created sites containing malware is to use some sort of proxy or Web filter that denies new sites not yet scanned and classified under a certain category (i.e. business, investing, news, social networking, etc.). While this strategy will help prevent new websites from compromising systems, it doesn't do anything for compromised legitimate sites allowed by default. For those sites, the best option is to ensure the enterprise security products in place are configured to combat the entire Web threat landscape, namely via real-time analysis of sites prior to serving them to users.

We couldn't have said it better ourselves. Make sure you use a proxy and a web filter, make sure your anti-virus is up to date, and use some type of real-time rating system or block unknown categories!