Cisco Systems, Microsoft, and the Rewarding Trade of Information Technology

Posted on August 1, 2009 by admin

My name is Donald Carroll. I am the President and Webmaster of Green Planet Fantasy Theater. How did I get here? I have over ten years of work experience in the field of Information Technology (IT). I also have five years of teaching experience as an instructor in both Microsoft and Cisco technologies as well as other networking technologies such as Novell Netware, Unix, and Linux. I am twice certified by Microsoft as a Microsoft Certified Systems Engineer (MCSE), and twice certified by Cisco Systems as a Cisco Certified Network Associate, or CCNA?

The field of Information Technology has been very good to me and is an excellent trade to get into for those of you looking at entering a career or changing careers. As a former instructor, I can tell you that as a prerequisite you must be at least comfortable with using computers; better if you have a knack for fixing them when they break! Those of you who are very familiar with using, repairing, and even building computers are perfectly cut out for the lucrative field of Information Technology.

The purpose of this article is to help you in getting started on the path towards earning your industry standard certifications in the field of Information Technology while also gaining hands on practical experience with computer networks. I will tell you on the next page exactly what to do if you are interested in entering the field of Information Technology, even if you have no experience whatsoever. In the field of Information Technology, it is often not enough to just earn your certifications as employers generally favor IT professionals with work experience.

I will also share with you more about my own background and how it helped me to enter the field of Information Technology.

In the early 1990′s I was working as an administrative assistant, and as part of my duties I learned how to use a number of different computer programs; common business applications including word editors, spreadsheet programs, and databases. After my stay as an administrative assistant, and while I was seeking new and interesting employment opportunities, I sent away for a PC (Personal Computer) home study course, mostly because it came with a PC! I learned computer hardware, and computer software, including operating systems such as Microsoft DOS and Windows version 3.1. (Learning computer hardware and computer software, including operating systems such as Microsoft Windows XP and Microsoft Windows Vista is the first step in training for a career in Information Technology. I will explain more about this on the next page.)

I was also able to connect to the Internet using a modem; at that time, the only real Internet choices there were was “GopherNet”, and the America Online Network. (“GopherNet”, which is still in existence today, allows you to view folders and files on a remote computer, not web pages. The America Online Network has merely changed over the years.) Besides then connecting to a rather bleak Internet, in comparison with today’s Internet, you could connect to what were called “BBS’s”, or electronic bulletin boards. These “sites” allowed you to chat, play online games, and both upload and download content. ( I would have to check to see if any “BBS’s” are still in existence today!)

In 1997 I relocated to the Silicon Valley (San Jose, California), and I began applying around for administrative assistant positions. One recruiter pointed out that I “had a list of computer skills a mile long” between having learned a number of business applications, and having also completed a two year home study course as a PC Specialist. I was offered a high paying short term contract to provide computer support for employees at NEC Computers. I was basically an apprentice to what I would call a “guru” in terms of computer and computer networking skills.

I also entered college again to earn an Associate of Science/Information Systems Degree. After my contract at NEC Computers ended I applied at Honeywell Automated and Industrial Controls, and I accepted a position as a hardware technician. At this point now in my life I was pursuing a second degree in Information Technology, and working in the field of Information Technology, developing on the job skills critical to become a real expert. (At that time, the field of Information Technology was called Management Information Systems (MIS). Later it was changed to Information Specialist (IS), and today it is known as Information Technology (IT)).

That was the beginning for me. I soon continued on to teach networking technologies, and I accepted senior engineering positions with a number of different companies and corporations. I WAS EARNING WAGES and BENEFITS PACKAGES I HAD NEVER DREAMED OF!!! I essentially climbed the ladder from working as a computer hardware technician to working as an instructor, a network engineer, a senior network engineer, and finally as a consultant! Today I work as a contractor and as a webmaster.

If you would like to enter the field of Information Technology yourself PLEASE CONTINUE READING!!! I have myself graduated over four hundred computer networking students, and I can teach you how to learn computer hardware and software, and computer networking. I will tell you what course books to study and how and what certification tests to prepare for.

The field of Information Technology is not about computer programming, or application development; this field is all about the designing, building, maintaining, troubleshooting and repairing both the computers and the computer networks that companies use to store and use their data. In considering computers, there is the computer hardware; the disk drives, cd-rom drives, memory, motherboard, processors, power supplies, mice, keyboards, and other parts and peripherals. There is also the computer software; namely, the operating system, like Microsoft Windows XP or Microsoft Windows Vista, and computer applications or programs, such as Microsoft Office or Adobe Acrobat Reader.

When one or more computers are connected together to form a computer network they are connected using network devices such as hubs, switches, routers, and other network devices. In the field of Information Technology some IT Specialists prefer to work on computer hardware and computer software, and special computers used in a computer network called network servers. Other IT Specialists prefer to work more with network switches, network routers, and other telephone and telecommunications equipment.

If you would prefer to work with networking devices more than with computer hardware, computer software, and servers, you might want to pursue getting certified as a Cisco Certified Network Associate, or CCNA. (The CCNA certification is either one or two exams; you have a choice of taking it as either one or two exams depending upon your preference.) Your duties as a CCNA would revolve more around configuring and troubleshooting network routers and switches, and working with leased line providers and telecommunications equipment. Cisco Systems also offers other more advanced routing certifications beyond the CCNA, namely the Cisco Certified Network Professional, or CCNP, and the Cisco Certified Internetwork Expert, or CCIE.

If you would prefer to work on computers; installing and fixing computer hardware and computer software, and administering network servers and network databases and applications, you might be interested in pursuing first the A+ certification followed by the Microsoft Certified Systems Engineer, or MCSE certification. (The A+ certification exam is given as either one or two exams; one exam is based on computer hardware and the other exam covers special software known to IT Specialists as operating systems. The Microsoft Certified Systems Engineer, or MCSE, is awarded upon the successful completion of seven individual exams.)

Many IT professionals maintain proficiency in computer hardware, software, network servers, and computer networking devices such as routers and switches. Many employers demand that their IT staff be able to help employees with simple computer problems while also being able to solve complex network problems on network routers, switches, and even firewall systems. Many positions in the field of Information Technology require an A+ certification, an MCSE, and a CCNA. Other positions require only one of these certifications, plus or many any of a number of other industry standard certifications.

Unless you decide to pursue the Cisco Certified Network Associate, or CCNA certification, you will probably want to begin learning the ins and outs of a single computer before studying computer networking technologies. You can purchase the textbooks for the A+ certification, the MCSE certification, and the CCNA certification at almost any book retailer.

Focus first on the A+ exam material before proceeding to the MCSE exam material and/or the CCNA exam material – this is best if you are an absolute novice. It is also a good idea to set up a small computer network at home to practice with – hands on experience with these technologies is essential to success! It is also a good idea to attend a technical school to learn the basics of networking technologies, but you can study and become proficient with these technologies on your own just as well.

With your A+ certification behind you, you can work as a PC technician, or even as a Help Desk Specialist (helping employees with their hardware, software, and basic network problems.) While pursuing your MCSE and or CCNA, you can apply for positions as a junior systems administrator, network administrator, and even a junior network engineer.

Study your exam materials, setup your own home network that you can use to practice on, and by all means try to meet people who work as IT Specialists so that you can learn more about working in the field of Information Technology. Maybe you can spend a day at work with them working for free as an apprentice? (Companies usually do not mind extra help for free!)

Create a sharp resume’ listing your certifications and/or technical school degrees, and your work experience…if you do not have any work experience, try to get some working with an IT Specialist. Though certifications are important, most employers prefer work experience. Some job interviews have a required technical interview where you are tested on your fundamental knowledge and your ability to troubleshoot and resolve computer and computer network problems.

Once you have passed you A+ certification exams you can begin applying to work as a computer technician (hardware and/or software technician.) From there you can continue your studies in networking, earn your MCSE and/or CCNA, CCNP, or CCIE, and become a network engineer, a senior network engineer, a contractor, or even work as a consultant.

Good luck to you…if you have any questions about the field of Information Technology please feel free to contact Donald Carroll at Green Planet Fantasy Theater.

(For more great “how to” articles, plus DVD Movies, Music Collections, PC, XBox, Wii, Sony Playstation and Nintendo Games, Software, E-Books, Audio Books, and Adult XXX Material FREE, visit Green Planet Fantasy Theater online at http://ww.myplanetfantasy.com.)

My name is Donald W. Carroll, and I am the President of Green Planet Fantasy Theater; a web site where you can download DVD Movies, Music Collections and Discographies, Audio Books and E-Books, XBox, WII, PlayStation, Nintendo, Super Nintendo, and PC Games, Computer Software, Desktop Themes, Wallpapers, Screensavers, Adult XXX Material, and much, much more, all for FREE!!!

Green Planet Fantasy Theater also houses a world class collection of “how to” articles. This year we hope to provide you with even more informational and instructional articles on many, many different topics.

I am also working very hard to establish Green Planet Fantasy Malls, where I will make available to you numerous different products and services, all hand picked, and at the BEST prices going online!!!

Visit Green Planet Fantasy Theater Online at http://www.myplanetfantasy.com

Security of Information Systems

Posted on July 26, 2009 by admin

We well know conception about complex solutions in the area of information systems security. These cover management of the information security, as well as projection and implementation of the technological solutions. Multiple-factor authentification solutions, identities management and access rights management, security of the workstations, and PKI. Also important is solutions in the area of the secured electronic signature. It is usually completed with establishing of the managing systems in the field of the information security, together with the projects for protection of personal data, continuity of the operations management, and management of the outsourcing in the field of the security and incidents. Key platforms used within frame of the safety of the information systems solutions, are technologies from manufacturers such as ActivIdentity, Check Point (Pointsec), Clearswift, Entrust, IBM, nCipher, Oracle, RSA, SafeNet, Sun Microsystems, Symantec, and Vasco.

http://www.infosecuritylab.com

Information Security Policy

Posted on July 26, 2009 by admin

Information Security Policy

For

Paoletti and Gusmano

Table of Contents

Introduction………………………………………………………………………………………………………………… 1

Ethics and Acceptable Use Policies ………………………………………………………………………… ……….1

Disciplinary Action……………………………………………………………………………………………………….. 2

Protect Stored Data……………………………………………………………………………………………………….2

Protect Data in Transit …………………………………………………………………………………………………. 3

Restrict Access to Data…………………………………………………………………………………………………..3

Physical Security……………………………………………………………………………………………………………3

Security Awareness and Procedures…………………………………………………………………………………4

Security Management / Incident Response Plan ……………………………………………………………… 5

Appendix A – Agreement To Comply Form ……………………………………………………………………….6

Security Policy

Introduction

This policy covers the security of company information and must be distributed to all company employees. Management will review and update this information security policy at least once a year to incorporate relevant security needs that may develop. Each employee must read and sign a form verifying they have read and understand this policy.

Ethics and Acceptable Use Policies

The company expects that all employees conduct themselves in a professional and ethical manner. An employee should not conduct business that is unethical or illegal in any way, nor should an employee influence other employees to act unethically or illegally. Furthermore, an employee should report any dishonest activities or damaging conduct to an appropriate supervisor.

Security of company information is extremely important to our business.

We are trusted by our customers to protect sensitive information that may be supplied while conducting business. Sensitive Information is defined as any personal information (i.e. – name, address, phone number, e-mail, Social Security number, driver’s license number, bank account, credit card numbers, etc.) or company information not publicly available (i.e. – clients, financial information, employee information, schedules, technology, etc.). It is important the employees do not reveal sensitive information about our company or our customers to outside resources that do not have a need to know such information.

Disciplinary Action

An employees failure to comply to the standards and policies set forth in this document may result in disciplinary action up to and including termination of employment.

Protect Stored Data

Protect Sensitive Information stored or handled by the company and its employees. All Sensitive Information must be stored securely and disposed of in a secure manner when no longer needed for business reasons. Any media (i.e – paper, floppy disk, backup tape, computer hard drive, etc.) that contains sensitive information must be protected against unauthorized access. Media no longer needed must be destroyed in such a manner to render sensitive data irrecoverable (i.e. – shredding, degaussing, disassembly, etc.).

Credit Card Information Handling Specifics

• Destroy cardholder information in a secure method when no longer needed. Media containing card information must be destroyed by shredding or other means of physical destruction that would render the data irrecoverable (shred, degauss, etc.).

• It is prohibited to store the contents of the credit card magnetic stripe (track data) on any media whatsoever.

• It is prohibited to store the card-validation code (3 or 4 digit value printed on the signature panel of the card) on any media whatsoever.

• All but the last 4 numbers of the credit card account number must be masked (i.e. – x’s or *’s) when the number is displayed electronically or on paper.

Protect Data in Transit

If Sensitive Information needs to be transported physically or electronically, it must be protected while in transit (i.e. – to a secure storage facility or across the Internet).

• Sensitive Information and Credit card account numbers must never be e-mailed without using proper encryption technologies (i.e. – PGP encryption).

• Media containing Sensitive Information and credit card account numbers must only be given to trusted persons for transport to off-site locations. Restrict Access to Data Restrict access to sensitive information (business data and personal information) to those that have a need-to-know. No employees should have access to credit card account numbers unless they have a specific job function that requires such access.

Restrict Access to Data

Restrict access to Sensitive Information (business data and personal information) to those that have a need-to-know. No employees should have access to credit card account numbers unless they have a specific job function that requires such access.

Physical Security

Restrict physical access to Sensitive Information, or systems that house that information (ex. computers or filing cabinets storing cardholder data), to protect it from those who do not have a need to access that information. Media is defined as any printed or handwritten paper, received faxes, floppy disks, back-up tapes, computer hard drive, etc.

• Media containing Sensitive Information must be securely handled and distributed.

• Media containing stored Sensitive Information (especially credit card account numbers and social security numbers) should be properly inventoried and disposed of when no longer needed for business by deleting, shredding, or degaussing before disposal.

• Visitors should always be escorted and easily identifiable when in areas that may contain Sensitive Information.

• Password protected screen savers should always be used on any computers that may contain Sensitive Information. Security Awareness and Procedures Keeping Sensitive Information secure requires periodic training of employees and contractors to keep security awareness levels high. The following company policies and procedures address this issue.

Security Awareness and Procedures

Keeping Sensitive Information secure requires periodic training of employees and contractors to keep security awareness levels high. The following company policies and procedures address this issue.

• Hold periodic security awareness training meetings of employees and contractors to review correct handling procedures for Sensitive Information. Offline Merchant Security Policy

• Employees are required to read this security policy and verify that they understand them by signing an acknowledgement form (see Appendix A).

• Background checks (such as credit and criminal record checks, within the limits of local law) will be conducted for all employees that handle Sensitive Information.

• All third parties with access to credit card account numbers are contractually obligated to comply with card association security standards (PCI/DSS).

• Company security policies must be reviewed annually and updated as needed. Security Management / Incident Response Plan

There will be an employee of the company designated as the security officer. The security officer is responsible for communicating security policies to employees and contractors and tracking the adherence to policies. In the event of a compromise of Sensitive Information, the security officer will oversee the execution of the incident response plan.

Security Management / Incident Response Plan

1. If a compromise is suspected, alert the information security officer.

2. Security officer will conduct an initial investigation of the suspected compromise.

3. If compromise of information is confirmed, the security officer will alert management and begin informing parties that may be affected by the compromise. If the compromise involves credit card account numbers perform the following:

• Contain and limit the extent of the exposure by shutting down any systems or processes involved in the compromise.

• Alert necessary parties (Merchant Bank, Visa Fraud Control, law enforcement)

• Provide compromised or potentially compromised card numbers to a Fraud Control within 24 hrs.

Appendix A – Agreement To Comply Form

Agreement to Comply With Information Security Policies

Employee Name __________________________________________Department ___________________

I agree to take all reasonable precautions to assure that company internal information, or information that has been entrusted to the company by third parties such as customers, will not be disclosed to unauthorized persons. At the end of my employment or contract with the company, I agree to return all information to which I have had access as a result of my position. I understand that I am not authorized to use sensitive information for my own purposes, nor am I at liberty to provide this information to third parties without the express written consent of the internal manager who is the designated information owner.

I have access to a copy of the Information Security Policies, I have read and understand these policies, and I understand how it impacts my job. As a condition of continued employment, I agree to abide by the policies and other requirements found in the company security policy. I understand that non-compliance will be cause for disciplinary action up to and including dismissal, and perhaps criminal and/or civil penalties.

I also agree to promptly report all violations or suspected violations of information security policies to the designated security officer.

Employee Signature ________________________________________Date_______________________

Resource Box

Frederick D. Paoletti, Jr. is the founding principal of Paoletti & Gusmano Attorneys at Law, a criminal defense and personal injury firm located in Bridgeport, Connecticut. For more articles related to protecting yourself during personal injury and criminal situations, please visit http://www.paolettilaw.net.

Facing the Information Security Hole in 2009

Posted on July 24, 2009 by admin

Facing the Information Security Hole in 2009:

The unacknowledged threat to our homeland and financial security

Every few days there is yet another breach of information security. And each breach seems to be The Biggest Ever, until the next one is announced.

It is now widely acknowledged by security experts from the federal government on down that the problem of data security breaches will get worse as the financial debacle worsens and companies cut spending and workers. Finally, there is growing awareness of one of the primary concerns of our team: it is inevitable that this compromised data will be used for terrorism.

As we talk with people interested in this issue, including security gurus, corporate governance and regulatory experts, privacy advocates, directors and officers, corporate lawyers, managers, and plaintiffs and class-action attorneys, we get a lot of questions about this cutting-edge subject. The answers help explain why the failure to secure information is a lurking national and global security threat, and the next shareholder derivative, director and officer liability, regulatory, consumer product safety, and class-action issue.

Why is an information security breach a potential national and global homeland security issue?

LW: Think about what data thieves do with stolen information. Data thieves drain your financial accounts, use your debit and credit cards fraudulently, use your identity and credit to open new accounts, create forged employment documents and other legal paperwork, and use your stolen identity to commit crimes and evade law enforcement. It is inevitable that some of this stolen information will be used to finance terrorism, and to create forged identities allowing terrorists to cross borders or access critical systems. This is what makes the current situation worse than even a global Enron and WorldCom fraud situation. Enron was, quote unquote, only about losing dollars. In the current meltdown, we are also losing data, on a massive scale that we have not even begun to grasp.

You said that an information security breach also creates potential class action, consumer product liability, shareholder derivative, D and O liability, and regulatory exposure. Explain.

LW: When companies have sensitive information and systems, they have certain obligations to protect that information. Those obligations are based on a variety of international, federal, and state laws; regulatory requirements and guidelines from government agencies; statements and representations made to shareholders, customers, consumers, and regulators; and agreements with customers, consumers, and other companies with which they do business.

When companies do not meet the requirements for information security, whether that shortcoming is willful or negligent, they have failed in their obligations to many stakeholders. Also, many of the statements made to these many stakeholders are Simply Not True.

You can think of a similar situation with an airline that has multiple safety requirements, and that represents to many stakeholders that it does certain things to meet these safety requirements. If that airline fails to meet the safety standards, whether through deliberate circumventing of the safety standards, or through carelessness, that company has a big problem with law enforcement, regulators, customers, shareholders, and class action plaintiffs. The individuals who flout those safety controls also have a big problem as far as their personal liability. That company and those individuals have an even bigger problem if the plane actually crashes.

I think of an information security breach as a plane that has crashed.

What are the implications for investors?

LW: The implications for investors include a loss of shareholder value if the company has an information security breach. The companies themselves acknowledge, including in industry standards and in company disclosures filed with the SEC, that a data security breach affects the brand, requires huge financial resources for incident response, remediation, audit, and legal expenditures, and increases insurance costs. So an information security breach obviously means that, despite spending hundreds of millions trying to manage security and risk, the system failed somewhere. The follow-on implications depend on whether the company met its own security obligations, or whether the company failed to meet those obligations.

If the company blew right on by the controls, it means that, in essence, the company did not tell the truth to the many stakeholders involved. Misrepresentation on these issues may mean that insurance coverage is voided, that legal and regulatory requirements, including Sarbanes-Oxley, were not met, and that the exposure of the company and the individuals who ignored the safety requirements is much larger than if the company had appropriately met its security obligations. This is a situation ripe for regulatory actions, shareholder derivative suits, claims against individual directors, officers, and managers, consumer and shareholder class-action suits, and criminal sanctions.

Why is the consumer the one on the hook when their personal and financial information is breached?

LW: My experience is that, regrettably, right now the financial industry tries to push all risk, and the consequences of an information security breach, onto the individual consumer, or onto the other companies with which it does business. I believe that to be wrong – if the financial company failed to meet its requirements, it bears at least part of the blame – the individual data thief, does not, of course, get off the hook.

Also, if it failed to meet its security requirements, the financial company should bear the costs of recovering from the breach, rather than passing that cost and inconvenience on to the consumer or customer.

I also believe that a financial company that does not meet security standards has a very dubious position in trying to impose unreasonable interest rates, late fees and other penalties, and aggressive collection practices on its customers.

I’ve heard a lot about criminal hackers who break into systems, or criminal data thieves who steal, for example, a laptop or a flash drive. Is that the kind of information security gap you’re talking about?

LW: Not exactly. The piece of the problem that I am describing, based on real-life experience, is how many in the financial industry ignore or bypass the safety standards, with the companies still claiming that they have done everything they possibly can, and are not responsible when there is an information security breach.

It’s easy for companies to blame the mean old computer hackers who break into the systems and steal the data. But that’s only part of the problem. Yes, the data thieves have committed criminal acts, and it’s appropriate that data thieves be held responsible for their actions.

The companies also like to blame careless vendors who provide unreliable products or services – that is a problem, as well.

But the financial companies also have multiple obligations to do their part to protect the information and systems. The financial industry itself acknowledges the obligation of the companies to conduct appropriate due diligence and security reviews before allowing other companies or individuals to access this data.

For financial companies to claim that they’re doing the very best they can is like a storage company that tells its customers that it has a secure fence, security alarms, and 24-hour on-site guards, but has a break-in because the guard left to go the neighborhood pub, and left the gate open and the alarm off. If your stuff is stolen, the individual burglar is at fault, but the company and the security-violating guard are also in trouble.

Aren’t the financial companies that have this data and systems legally required to ensure its security?

LW: Yes, the financial companies are legally required to protect this information. There are many laws and regulations that impose these requirements. (The particular laws and regulations will vary, according to the industry, the type of company, and the type of information.) But the gap that I’m describing arises because many companies, and other stakeholders, assume that the companies are meeting the safety standards because they spend a lot of shareholder money on security.

The companies themselves, not to mention the regulators and the other parties concerned, do not understand that these gaps exist, or how to find and fix them. It has not been well explained because, until very recently, almost nobody connected with the financial industry had any appetite for refusing to greenlight risky deals – they concentrated on volume and speed of the deal transactions. This approach has created the ‘credit default swap’ of sensitive information.

How does this gap happen?

LW: Many of these gaps happen in the deal-making and deal-managing process. The financial industry is well aware of the many laws, regulations, and safety standards, and has been for years. The industry trade groups, and the companies themselves, specify that the safety reviews are supposed to be completed before any deal is done, if that deal involves any access to sensitive systems and data. Think of this as a requirement in the aviation industry that safety checks are supposed to be completed before a plane takes off. That does not mean that the crew does not keep an eye on things during the flight, but the plane is not supposed to leave the ground until it’s been checked and cleared by experts.

Now, what happens a lot in the financial industry is that a project is pushed along, and a deal is approved, giving another company access to sensitive data, before the safety reviews are completed and the shortcomings addressed. That is like putting a plane in the air before completing the safety checks, for no reason other than ‘we need to meet a schedule’ or ‘the safety checks take too much time’.

The deal-making and contract function should be one of the strongest and most effective control points for the industry – it is the last best chance to meet these safety standards before the ‘deal plane’ takes off. Unfortunately, because the financial industry has focused on volume and speed of deals, it is, in my experience, one of the weakest, with the deals frequently done by teams who do not understand the safety standards, or even the verbiage of the contracts.

Many in the financial industry treated this due diligence and deal function as a paperpushing drill to be done as cheaply and quickly as possible. That’s like having a plane checked out by an inspector who not only is not qualified to verify aircraft safety, but literally does not know what the words on the safety checklist mean.

How do you know about this?

LW: I managed deals, involving sensitive systems and data, for three international financial organizations. The subsidiaries of these global organizations included banks, mortgage companies, insurance, financial advisors, and credit cards. I also have many colleagues with experience in other global financial companies. This is an enormous and industry-wide problem that demands attention.

Well, if you worked in the financial industry, and now you’re saying the industry is not doing its job, aren’t you changing sides?

LW: I have always worked to secure sensitive information and systems, including in my work with three large international financial companies. That work involved knowing how to find and fix these problems, which was not a common skill in an industry that was paid on volume and speed of its deals. Sometimes it also involved refusing to greenlight projects until the appropriate security protections were in place. While that work was much appreciated by the control teams, like information security, compliance, and corporate governance experts, it was sometimes not popular with teams that wanted to rush projects through without taking time for the necessary precautions.

So I now work to educate the multiple stakeholders that this is a huge security hole, but it’s fixable – I’ve done it.

Why do you care so much about this? What’s in it for you?

LW: As it turns out, my entire career, beginning with my first U.S. Army job in Military Intelligence, has been about the protection and appropriate distribution of sensitive data. In my units, people were prepared to die to protect highly sensitive systems, the compromise of which could cause grave harm to our security and our people. It was unbelievable to me that some in the financial industry failed to protect sensitive information, just because they found it inconvenient, or because extra time and due diligence on a project might delay a promotion or payment of a bonus.

Given a choice between signing off on reckless manager decisions, or protecting our sensitive information, which means protecting our security, our customers and our shareholders, I have to side with protecting this data.

When you describe these gaps and how they happen, is this real-world information?

LW: The descriptions of these gaps are based on real-world, hands-on experience, not theory. I am not interested in enabling new data thieves; I want to help educate, so that the security holes can be found and fixed before there’s a security breach. If I know of specific weaknesses in a company’s system, I believe that it’s appropriate to first notify that company so that they can take proactive protective measures, whether with our team or with someone else. But even when I publicly discuss typical scenarios at an extrapolated level without naming the company, these examples are based on facts that I and my colleagues have witnessed first-hand.

What advice can you give companies that aren’t sure whether they are exposed?

LW: Many companies think that they have everything covered, because they have internal or external auditors, or big consulting companies, or other teams that have been trying for years to address security. But my colleagues and I have identified these gaps, even in some of the largest companies in the world that spend enormous amounts of shareholder money on security. In fact, the problem is probably worse in a larger company, because it’s more difficult for various teams to coordinate information and react quickly to address gaps. I can attest that we have identified significant security gaps that had been missed for years, even a decade or longer, by the internal and external teams at some of the largest companies in the industry.

What advice can you give companies that are sure they have this problem handled?

LW: Firstly, many financial companies assume that, because they spend a lot of time and money on security, they must have it covered. That assumption may prove fatal.

For companies that choose to assume that they have this covered, even after this widespread but unrecognized risk has been explained, my only advice is: Don’t have a breach.

Don’t have an unhappy worker with a flash drive; don’t have a contractor or subcontractor who wants to use this data for harmful purposes; don’t have your data being accessed by anyone that you don’t know; don’t have anyone working in your data centers or accessing them remotely unless you know about and monitor it; don’t have any gaps in any of the products or services anywhere in your data chain. Don’t make any mistakes in what you say to consumers, customers, regulators, investors, or companies with whom you do business.

If you’re still sure you have it covered – Don’t Have A Breach.

The author gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and Information-Security-Resources.com.

By Laura Wilson, Information-Security-Resources.com Corporate Liability Editor. Laura is a business consultant and an advocate for information security, consumer protection, long-term shareholder value, and better management decisions. Her specialty is finding and fixing risks and threats to sensitive data. Her experience includes international banking, credit card, and mortgage companies, venture capital portfolio companies, and software and technology providers. She practiced law in Silicon Valley during the tech boom and meltdown, handling corporate governance and information protection.

Learn How Microsoft is Balancing Information Communication Technology at the 2008 Government Technologies Conference and Expo

Posted on July 23, 2009 by admin

Learn How Microsoft Is Balancing Information Communication Technology at the 2008 Government Technologies Conference and Expo

March 25, 2008 – Toronto, Canada – John Weigelt, National Technology Officer, Microsoft Canada, will be keynoting at the 2008 Government and Health Technologies Conference and Expo, taking place April 15 -16, 2008 at the Design Exchange in Toronto Ontario.

John Weigelt will discuss the fundamental issues facing government and healthcare today – achieving the right balance between ICT and the growing demands of the technically savvy citizen and business and the critical needs of patients and healthcare workers.

Microsoft believes that the time has come for a serious re-examination of the ICT options facing government and healthcare organizations, with a tide of increasing expectation and massively more technical capability, the trick is to ensure that our governments and hospitals are waving and not drowning in the turbulent mix.

So, register now to learn more about the Microsoft Solutions and Strategies for government and healthcare to embrace technology to meet the needs of patients and citizens alike while improving internal efficiencies and the jobs of your employees. This strategies and solutions are built with research driven data, market-proven Microsoft infrastructure components, uses open standards, and includes a set of common transactions that enable critical functions to be rapidly provided to citizens, patients, businesses and your employees.

This session is designed specifically for Microsoft Canada to gain insight from our strategic Municipal Government Chief Information Officers and Senior IT decision makers around its CGF and its key building blocks impacting Municipalities: Solution Oriented Architecture and Enterprise Application Integration, Communication and Collaboration, Security, Compliance and Privacy, as well as overall management.

The Microsoft Connected Government Framework is designed to assist municipalities to develop corporate infrastructure environments that will support the transformational technology projects across the breadth of their organization. The CGF helps ensure that value invested in current legacy applications continues to be realized while municipalities improve and update their solutions to deliver superior value to the constituents.

To register for Early-Bird Passes please visit http://gov.wowgao.com/registration OR call (416) 292-0038 Ext. 812.

About Microsoft Corporation

Microsoft Corporation (NASDAQ “MSFT”) is the worldwide leader in software, services and Internet technologies for personal and business computing.

Microsoft Canada Co. was founded in 1985. As the Canadian subsidiary of Microsoft Corporation in Redmond, Washington, the company provides sales, marketing, consulting and local support services in French and English. Microsoft Canada has grown from five people in 1985 to more than 900 employees. It also has strong relationships with more than 24,000 partners across Canada. More than 1,100 of these are Microsoft Certified Partners, and over 200 are Gold Certified Partners. Headquartered in Mississauga, Microsoft Canada has regional offices in Toronto, Vancouver, Calgary, Edmonton, Winnipeg, Ottawa, Montreal, Quebec and Halifax.

About the 2008 Government and Health Technologies Conference & Expo:

The 2008 Government and Health Technologies Conference and Expo will focus on the latest IT products and solutions being developed and sought after in the healthcare and public service sector, including Web 2.0, Patient Monitoring Systems, Document Management, Business Intelligence, Mobile Data Systems, RFID Solutions, Biometrics and much more.

As one of Canada’s leading annual IT conference and exposition, the event features ground breaking IT applications that aim to educate key IT professionals, Government officials, developers, architects, engineers and medical professionals with the necessary tools and techniques for the reliable, effective management of all public information services across Canada. For more information about the event, please visit http://gov.wowgao.com

About WowGao Inc.

Government & Health Technologies Conference and Expo, April 15 & 16, 2008

Wireless & Mobile Expo and Conference, July 15 & 16, 2008

RFID Forum, July 15 & 16, 2008

Financial Services Technology Forum, October 2008

For more information about the events, please visit http://www.wowgao.com/

For conference inquiries:

Conference Producer

(416) 292 – 0038 ext. 840 | conference@wowgao.com

WowGao Inc. | www.wowgao.com

Learn How Microsoft Is Balancing Information Communication Technology at the 2008 Government Technologies Conference and Expo

To register for Early-Bird Passes please visit http://gov.wowgao.com/registration OR call (416) 292-0038 Ext. 812.

About Microsoft Corporation

Microsoft Corporation (NASDAQ “MSFT”) is the worldwide leader in software, services and Internet technologies for personal and business computing.

About the 2008 Government and Health Technologies Conference & Expo:

About WowGao Inc.

Government & Health Technologies Conference and Expo, April 15 & 16, 2008

Wireless & Mobile Expo and Conference, July 15 & 16, 2008

RFID Forum, July 15 & 16, 2008

Financial Services Technology Forum, October 2008

For more information about the events, please visit http://www.wowgao.com/

For conference inquiries:

Conference Producer

(416) 292 – 0038 ext. 840 | conference@wowgao.com

WowGao Inc. | www.wowgao.com

WowGao Inc. is an award winning leading event management company that produces, since 2003, internationally renowned conferences and expositions that address the latest innovations and developments in the information technology industry. Our featured events include:

Government & Health Technologies Conference and Expo, April 15 & 16, 2008

Wireless & Mobile Expo and Conference, July 15 & 16, 2008

RFID Forum, July 15 & 16, 2008

Financial Services Technology Forum, October 2008

For more information about the events, please visit http://www.wowgao.com/

Information Security Software : E-Signatures

Posted on July 23, 2009 by admin

E-Commerce (EC)

The conducting of business communication and transactions over networks and through computers. As most restrictively defined, electronic commerce is the buying and selling of goods and services, and the transfer of funds, through digital communications. However EC also includes all inter-company and intra-company functions (such as marketing, finance, manufacturing, selling, and negotiation) that enable commerce and use electronic mail, EDI, file transfer, fax, video conferencing, workflow, or interaction with a remote computer.

E-signature – The definition

A digital signature is an electronic (code) signature that can be used to authenticate the identity of the sender of a message or the signer of a document and to ensure that the original content of the message or document that has been sent is unchanged. Digital signatures are easily transportable, cannot be imitated by someone else, and can be automatically time-stamped. The ability to ensure that the original signed message arrived means that the sender cannot easily repudiate it later.

A digital signature can be used with any kind of message, whether it is encrypted or not, simply so that the receiver can be sure of the sender’s identity and that the message arrived intact. A digital certificate contains the digital signature of the certificate-issuing authority so that anyone can verify that the certificate is real.

A more formal definition: “(I) A value computed with a cryptographic algorithm and appended to a data object in such a way that any recipient of the data can use the signature to verify the data’s origin and integrity.

(II) Data appended to, or a cryptographic transformation of, a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery, e.g. by the recipient.”

Source: IETF (http://www.ietf.org/rfc/rfc2828.txt).

E-signature – How It Works (with PKI)

Assume you were going to send the draft of a contract to your lawyer in another town. You want to give your lawyer the assurance that it was unchanged from what you sent and that it is really from you.

1. You copy-and-paste the contract (it’s a short one!) into an e-mail note.

2. Using special software, you obtain a message hash (mathematical summary) of the contract.

3. You then use a private key that you have previously obtained from a public-private key authority to encrypt the hash.

4. The encrypted hash becomes your digital signature of the message. (Note that it will be different each time you send a message.)

At the other end, your lawyer receives the message.

1. To make sure it’s intact and from you, your lawyer makes a hash of the received message.

2. Your lawyer then uses your public key to decrypt the message hash or summary.

3. If the hashes match, the received message is valid.

E-signature – The facts we all must know

It is evident from various definitions of e-signature and legislation enacted so far that almost everyone has tried to maintain technology independence so far. But generally it is also seen that use of PKI is catching up as a popular method of creating e-signatures (digital signatures) worldwide.

Use of PKI has some merits, over other methods, which are clearly seen as convenient and secure by the industry and businesses deploying such solution. The convenience of sharing keys, irreversible hashing algorithms and association of keys to an individual using digital certificate issued by a trusted party (Certificate Authority) have mainly contributed to this wining recipe.

A Certificate Authority (CA) issues a digital certificate with the information provided by the certificate subject, verifies information provided for correctness, digitally signs this certificate, associates such certificate with a public key and also publishes this key through its repository.

Through intelligently drafted legal agreements CA also puts all the responsibility liability on the certificate subscribers and relying parties whereas most popular internet browsers and email clients provide mechanism to trust a certificate implicitly or explicitly.

In such scenarios it very important for all to make sure that the certificates are only trusted and relied upon if these are issued by a trusted CA and are validated by issuing authority as not expired and/or revoked. Adding any certificate explicitly to the trust list maintained by your operating system is no less than committing hara-kiri.

CA is required to publish its Certificate Policy (CP) and Certificate Practice Statement (CPS) along with other agreements such as Subscriber’s Agreement & Relying Party’s Agreement. Equally important is the fact that all parties must understand and exactly know indemnities and warranties listed in various legal contracts.

The digital certificate verifies that the key pair used for the digital signature is associated to the person whose information is provided in the certificate. The certificate may also associate a person to an enterprise as authorized signatory. This demonstrates total dependence on the trust relying party must have in the certificate issuing authority (issuing CA) and his ability to get the certificate verified from the CA. It is an accepted fact and recommended best practice to not trust a certificate that cannot be verified for its validity, this means the CA must provide online certificate validation in real-time. Any CA just providing Certificate Revocation Lists is not good enough for serious business.

Trusting a CA must always be a well-thought decision and must be based on good knowledge of the security of the CA it self, its policies and practices pertaining to certificate lifecycle management, hiring of staff, access to sensitive information and areas (physical access), segregation of staff duties etc. An individual needing to rely on a digital signature should not have to be well-informed of all the legal and contractual intricacies on the contrary the individual will be more comfortable if there is some external entity that can audit and accredit certificate issuing CA as trustworthy.

Conclusion

There is no doubt that we have come a long way in improving these technologies to provide the comfort and trust to parties conducting business through electronic documents and transactions from one end of the world to the other there is even more need for governance in a totally new territory for all of us. And I must also be content with these (web) technologies for providing such convenient ways of researching, collecting information and doing business with such speed that would not have been possible only a few decades back.

We offer Information Security Software Solution for System Auditing, Risk Management Utilities, Vulnerability Scanners,Auditing Tools,Penetration Testing Tools, Forensics Tools and Regulatory Compliance.

Changing Scenario of Information Exchange by Network Administration

Posted on July 23, 2009 by admin

Network Administration is different from System Administration. In System Administration all tasks are concerned with one independent computer system. In case of Network Administration once you put your system on a network, it interacts with many other systems. In today’s fast paced world everybody is demanding for modern network which is much superior to the earlier ones. We need improved security and better network management.

Network administration commonly includes activities such as network address assignment, routing protocols and configuration of Authentication and Authorization –directory services. It often includes maintenance of network facilities in individual machines, such as drivers and settings of personal computers. It sometimes also includes maintenance of certain network: gateways, intrusion detection system, etc.

The task of Network Administration is done by Network Administrator. Network Administrator is responsible for network design and security.

Designing:

Designing a network is termed as Network Architecture. Network Architecture can be defined as the design principles, physical configuration, functional organization, procedures, and data structures used for designing and construction of a communication network.

In this fast changing scenario the term Network Architecture also denote classification and differentiation of distributed computing architecture.

To tackle with the collision issue a certain set of rules are also defined which ensures not more than one computer can send across a packet through data cable.

Security:

Sometimes security has more to do with politics and human resources issue than networking. A security administrator is mostly put into abeyance in deciding priority to maintain a reasonable level of security or providing flexibility to users to get their job done. A security administrator has to seek balance between these two opposite wants. Security should be like clothing as clothing are so designed that they are not to tight so that it does not restrict movement and it should not be so loose that it gets revealed to public.

When thinking of securing a corporate network three ways should be kept in mind that someone can get access to the corporate network:

1) Through the Internet.

2) Through dial-in-access.

3) Through Virtual Private Networks.

Network Management System:

Network Management Systems is a combination of both the hardware and software used to monitor and administer a network. Individual network elements are monitored by Element Management Systems.

Network management refers to the activities, methods, procedures, and tools that pertain to the Operation, administration, maintenance, and provisioning of networked systems.

• Operation deals with keeping the network (and the services that the network provides) up and running smoothly. It includes monitoring the network to spot problems as soon as possible, ideally before users are affected.

• Administration deals with keeping track of resources in the network and how they are assigned. It includes all the “housekeeping” that is necessary to keep the network under control.

• Maintenance is concerned with performing repairs and upgrades – for example, when equipment must be replaced, when a router needs a patch for an operating system image, when a new switch is added to a network. Maintenance also involves corrective and preventive measures to make the managed network run “better”, such as adjusting device configuration parameters.

• Provisioning is concerned with configuring resources in the network to support a given service. For example, this might include setting up the network so that a new customer can receive voice service.

Changing Dynamics of Network Administration:

Perhaps you prefer to work outside the office, say, on the golf course. When you’re away it would be useful to monitor your servers and network remotely. You’re in luck; there are a bevy of utilities that let you monitor, diagnose, and repair problems and perform administration tasks remotely with a smartphone or handheld device linked to one of your data center servers.

Most offerings let you manage passwords, printer connections, email programs, or database servers with a Blackberry, Palm Tree, or Nokia smartphone linked to a network server, which is linked to the rest of your network. But while Avocent’s Sonic-Admin, Ecutel’s IC2 (Infrastructure Command and Control), MobileControl from ASG, and other solutions probably work well; many administrations have reservations about security.

Security Concerns

The idea of network management applications using a wireless device represents a dream come true for many network administrators, but it will be a while before the concept takes hold. In fact, the potential market for such utilities is huge, but security concerns have reduced it to only a fledgling market, and the utility’s debut has been too small to track, says analyst Gerry Purdy of Mobile Trax.

“Of course, demand for this type of application will eventually grow as smartphones will have more feature sets and can handle the software loads necessary,” Purdy says. “But at the same time, these devices and applications represent security [threats] in the minds of [IT administrators], such as when a person leaves the company and has access to the network with his mobile device or when a mobile device might provide the opportunity for someone to hack your network with a smartphone.”

Acknowledging that appeasing security concerns represents the toughest sell, Robert Touw, a business development manager for Avocent’s mobile solutions group, maintains that IT administrators are increasingly buying into both the idea of remote network management and the security that the utilities can offer. He also says that even some financial firms, for which security is of utmost concern, now use the utility.

Wireless & Remote Freedom

Most of all, IT administrators relish the opportunities wireless and remote network administration offers. “There is quality of life: Suddenly you don’t have to give up dinner to fix something right away,” Touw says. “Now, suddenly you can also do things in 10 minutes that used to take 40 minutes.”

For security, Avocent says SonicAdmin offers 3DES encryption and token transaction authentication so that the server only accepts valid data packets with recognized tokens. Authentication levels, backed by RSA SecurID, include SonicAdmin user account authentication, device authentication, and NT/AD authentication plus optional RSA SecurID integration. Data such as confidential network and personal logon is not stored on mobile devices. Additionally, remote administrative actions are logged on both the SonicAdmin server and managed servers.

Ecutel says its IC2 software offers six security layers. The server, on which it runs, for example, sits behind the data center’s firewall and signals to and from the server, and mobile devices use a minimum of 128-bit encryption. Authentication is based on a Web-based administration client and RSA SecurID. There is also a complete audit trail of IC2 server operation, and IC2 automatically times out after 30 minutes of inactivity.

ASG says users of its MobileControl Administrator’s management interface are required to log in using a PIN and domain credentials. The systems also can take advantage of RSA SecurID, SSL, VPN, and third-party wireless gateway server security solutions. Sensitive information, such as passwords, is never stored on the wireless device, and an automatic timeout feature for each mobile device prevents illegal entry into the network if a wireless device is lost or stolen.

According to Purdy, the application will likely eventually take hold once vendors convince IT administrators that the security risks can be minimized. Purdy says, “It is just a matter of these companies getting the word out that [these utilities] are secure and that they work.”

IT consultant employed with Rockaway Technology.
www.rtginc.net