Reporter's Notebook: IT Security

Mitch Betts   Today’s Top Stories   or  Other Security Stories  

Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management Achiving Compliance Through Good Governance Enabling Identity and Security Management with Open Source Should You Install Messaging Security Software on Your Exchange Server? Death to PST: Hidden Cost of Email Mismanagement Archiving Compliance with Sunbelt Exchange Archiver Learn-Fast Guide: Software as a Service is Growing Up The Business Value of Tape Storage Computerworld Technology Briefing: An open-source path to optimal virtualization Sign up to receive Security Resource Alerts

July 15, 2002 (Computerworld) -- A roundup of case studies and industry insights on IT security, from password resets to the future of managed security services.
The Plague of Password Typos
It's a bummer when employees forget their passwords or get locked out of a system because of password typos. And it's even worse when the network administrator has to be summoned at 2 a.m. to reset the password.
That was a weekly occurrence for Jeff Bair, senior LAN administrator at American Color Graphics Inc., a printing unit of ACG Holdings Inc. in Brentwood, Tenn. So he turned to the Password Station.Net 2.0 software from Avatier Corp. in San Ramon, Calif. A Web-based interface allows allows end users to securely and easily reset their forgotten passwords, set new passwords and unlock their accounts -- all without IT intervention.
Before, employees frequently locked themselves out of their own accounts by leaving the caps lock key on while typing their case-sensitive passwords, Bair says. And when an employee was locked out of the system, it could mean missed printing deadlines.
Bair obviously likes the self-service nature of the software, as well as the ability to check whether the password meets his security policy.
"It frees up time for me to work on other projects. And my wife wasn't liking those 2 a.m. calls either," Bair says.

Managed Security Services: Take It In-house?
Managed security service providers in the traditional mold -- where the service is provided from a remote operations center -- are struggling and consolidating. The wave of the future, says Thomas A. Gluzinski, CEO of Paladin Technologies Inc. in Schaumburg, Ill., is to bring that same expertise to the user's premises.
That's what Paladin is doing in the federal sector, and Gluzinski claims that the practice will also take hold in the commercial sector. The service provider brings in its own expert staff or hires the existing security staff, but either way, they stay on-site to handle security chores.
"These are people who know and understand firewalls, intrusion detection and signatures for attacks. Quite frankly, there aren't a lot of people out there with that skill set," Gluzinski says.
He says another hot trend is getting security assessments from service providers such as Qualys Inc. on a subscription basis. Redwood Shores, Calif.-based Qualys says that companies such as Deloitte & Touche LLP and Tower Records have signed up for its managed vulnerability assessment services.

Open Source Helps Hospital
It's important for a leading health care facility to protect sensitive medical information from hackers, so getting an intrusion-detection system (IDS) may seem like a no-brainer.
Mount Sinai School of Medicine in New York took the approach of using an open-source IDS: the OpenSnort Sensor appliance from Sourcefire Inc. in Columbia, Md.
Ken Redman, computer operations manager at the school, says he likes the open-source nature of the product. "Configuration is easy because it's open source. I can take a rule out or add one in," he says. And setup took only 20 minutes, Redman adds.
In terms of security, OpenSnort has demonstrated the huge number of probes and viruses that have tried -- and failed -- to get into his systems, Redman says. "We get hit with the Code Red virus every day, but it's been stopped [externally]," he says. "That just floors me. It's not gone."

Fast Certificates
Getting digital certificates for e-commerce transactions can take three to five days using conventional vendors. But that wasn't fast enough for Tim LeGrand, owner of Superior-Host International, an Indianapolis-based Web hosting company for online merchants. He says the delay has cost him customers.
So LeGrand is using QuickSSL from GeoTrust Inc. in Wellesley, Mass. GeoTrust's Secure Sockets Layer (SSL) product provides fast delivery of 128-bit, SSL digital certificates for encrypting communications between Web browsers and servers. The company's authentication systems process and respond to certificate requests automatically -- within 10 minutes.
LeGrand says the new certificate can be installed and running in about 30 minutes, a convenience customers appreciate.
He says the process is faster with GeoTrust because business information is collected via online forms, rather than from numerous faxed documents. LeGrand says he's satisfied that the GeoTrust process is sufficient to prevent fraud.

Security as Byproduct
Sometimes, better security is the byproduct of another IT effort. For example, Orem, Utah-based Morinda Inc. is migrating to the Microsoft Exchange 2000 platform by the end of this month, with help from bv-Control from Houston-based BindView Corp. The product helps administrators manage Microsoft Exchange environments.
One result is that Jon Williams, global information systems administrator at Morinda, has a better handle on his company's e-mail system. Using the BindView software, he can monitor the content of e-mail messages and control access and permissions, he says.
"And if there's a dangerous e-mail -- like a message from an employee quitting or a virus that the antivirus software doesn't pick up -- I can kill those e-mails in one fell swoop," Williams says.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

Feds finally put teeth into HIPAA enforcement iPhone 3G owner sues Apple, AT&T over dropped calls, app crashes Mozilla: Firefox is faster than Chrome More top stories...

Mozilla updates Firefox 3.1 with Alpha 2 build At 10, Google reiterates commitment to CIOs Microsoft explains Seinfeld-Windows TV ad: just a 'teaser'

Microsoft warns of IE8 lock-in with XP SP3 Users of Windows XP SP3 who try out IE8 Beta 2 won't be able to uninstall either one under certain circumstances. Opinion: Why Google has lost its mojo -- and why you should care Google has gone from innovative upstart to fat-and-happy industry leader in what seems like record time. Preston Gralla explains. Review: Internet Explorer 8 Beta 2 offers some nifty new features Microsoft's latest beta of IE8 includes better tab management, new services such as Web Slices and Accelerators, and the new 'porn mode.' IT Schools to Watch 2008 These leading-edge graduate schools are moving at the pace of the IT workplace, delivering coursework that's relevant to today's IT professionals. Windows Vista A to Z Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS. More Continuing Coverage After 9/11: Homeland Security Apple's iPhone Ask a Premier 100 IT Leader Bill Gates steps down BlackBerry Legal Battle Data Security Breaches Electronic Voting Firefox H-1B Visas HP's Boardroom Scandal Handheld Devices Hurricane Katrina Aftermath Microsoft Legal Issues Microsoft's Vista Open Source RFID Technology SCO's Linux Fight Sarbanes-Oxley Act Spam Voice Over IP Wi-Fi Windows Meta File Vulnerability Windows XP Service Pack 3 IT Careers 2010 Four years from now, the IT field will be a vastly different place. Will you be ready? More Special Reports Premier 100 IT Leaders 2007 Best in Class 2006 Computerworld Horizon Awards 2006 Premier 100 IT Leaders 2006 Salary Survey 2007 Best Places to Work in IT 2007 IT Forecast 2007 Premier 100 IT Leaders 40 Years of Computerworld ASPs, Take Two Best Places to Work in IT 2003 Best Places to Work in IT 2004 Best Places to Work in IT 2005 Best Places to Work in IT 2006 Business Intelligence Home Runs Business Intelligence: Smarter BI Business Intelligence: The Future of BI CRM Goes Vertical CRM: Sober CRM Career Planning Guide 2005 Careers: IT Profession 2010 Computerworld Horizon Awards 2005 Data Management: Mining for Gems Data Management: Taming Data Chaos Development: Hard-Workin' Web Sites Development: New Tools New Choices Development: The New World of Application Development Development: The Web Services Tsunami Development: Web Services Hurdles Disaster Recovery: Preparing for the Worst E-commerce Grows Up E-mail/Groupware: Big Decisions Faces of Mobile IT Forecast 2006 Global Mobile Hardware: Multiple Cores, Multiple Challenges Hardware: On-Demand Un-Hyped Hardware: The Shape of Things to Come Horizon Awards: 10 Cool Cutting Edge Technologies IT Management: Guide to Managing Vendors IT Management: Navigating Global IT IT Management: Recovery Ahead IT Management: The Future of IT IT Management: The Resourceful Project Manager Innovative Technology Awards 2004 Management: Reinventing IT Microsoft in Transition Mobile/Wireless Leaders and Laggards Mobile/Wireless: The Untethered Worker Mobile/Wireless: Tiny Gadgets, Huge Costs Network Management: Taking Control Networking: Turbulence Ahead! Networking: VoIP Goes Mainstream Operating Systems: In the Slow Lane Operating Systems: Linux Goes Global Operating Systems: Should You Nix Unix? Outsourcing: Offshore Buyer's Guide Outsourcing: Outsourcing Dangers Premier 100 IT Leaders 2004 Best in Class Premier 100 IT Leaders 2005 Best in Class ROI: Do the Math! Salary Survey 2003 Salary Survey 2004 Salary Survey 2005 Security Action Plan Security: Compliance Headaches Security: Proactive Security Security: Risk and Reward Security: Tips From Security Pros Souped-up Security Storage: Battling Complexity Storage: Cheap & Secure Data Stores Storage: Stretching Your Storage Dollars Storage: The Lean Storage Machine Storage: The New Rules of Storage Storage: The Ultimate Backup Guide Supply Chain: Missing Links Supply Chain: RFID Reality Check The Business of Security Web 2.0 Security Wireless: Wireless At Work All Zones Application Performance Zone Business Continuity Zone The File Data Management Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Business Intelligence and Analytics Zone Windows Protection Zone Identity & Security Management Zone See your link here

From Laggard to Leader: Transforming the Data Center From Laggard to Leader: Transforming the Data Center Register for this complimentary live webcast today! Go to the webcast  Computerworld Executive Bulletin: Building a Robust Antivirus Defense Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. (Source: MessageLabs) Antivirus software alone isn't enough to prevent today's speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and restricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more. Download this executive briefing  Online Security Issues in Regulated Industries Download this research paper, free for a limited time, compliments of Webroot! (Source: Webroot Software) In June 2008, Computerworld invited IT and business leaders to participate in a survey on online security initiatives at their organizations. The goal of the survey was to better understand Web and e-mail security issues faced today within the regulated education, financial services, government and health care industries. The following report represents top-line results of that survey. Download this white paper  White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. Archiving Compliance with Sunbelt Exchange Archiver Death to PST: Hidden Cost of Email Mismanagement Extend, Replace, or Convert; which is the best way forward for COBOL Applications? View more whitepapers

• Feds finally put teeth into HIPAA enforcement
• Mozilla updates Firefox 3.1 with Alpha 2 build
• iPhone 3G owner sues Apple, AT&T over dropped calls, app crashes
• More top stories 

Security Management Zone Security management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones

Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day. New baits

Identity & Security Management Solve your compliance problems and mitigate risk. Automate, validate and enforce business governance with Novell Identity Management and Security solutions. Learn more in the Identity & Security Management Zone See All Zones

In Security Stripping away the trappings of applications, systems and networks, information is the core asset of most organizations. Our columnist describes how asserting the importance of information governance is crucial to making that asset tangible, addressable and protected. Click here to read the latest column by Jon Espenschied