[Vision2020] Very Comforting Infirmation

[Art Deco]

Hackers step up attacks on security firms
By InfoWorld Tech Watch
Created 2011-03-25 11:29AM

The Internet's security infrastructure is under attack. Two major incidents against Comodo and RSA have raised the question of not just whether the enterprise can withstand hacker attacks but if the security firms we all count on to guard the infrastructure can protect themselves.

Earlier this week, Internet security firm Comodo revealed it had been tricked into minting nine high-value digital certificates [1] that could allow the attackers to create fraudulent sites that fool users into thinking they are visiting Google, Yahoo, Skype or Microsoft's Live service. The sting on Comodo follows a more serious attack on RSA [2], which netted the infiltrators unspecified information that could compromise the security of the company's one-time password product SecurID.

These breaches follow other recent high-profile security events, including Anonymous's campaign to compromise HBGary Federal [3] and Stuxnet's use of stolen code-signing certificates [4] against Iran's nuclear capability. Altogether, it's undeniable that attackers now see the value in focusing on those companies and products that provide defense.

While the Comodo attack, at least, is thought to have limited impact, the RSA compromise could be more serious. However, both breaches point to a need by security firms to re-evaluate their approach to protecting themselves and their valuable intellectual property, says Anup Ghosh, founder and chief scientist of browser security firm Invincea. "How is it that the foundational elements of security are being compromised?" he asks.

"We have to worry whether we are going to be targeted next -- we, as in the royal we," Ghosh says. "And all we're really doing is doubling down on the technologies that was built in the late '90s and address yesterday's problems rather than the way that these attacks are actually perpetrated."

Hackers have always sought out corporate intel, but in a presentation at RSA, Josh Corman, research director of the 451 Group, argued that attackers are increasing their focus on intellectual property [5], at a time companies are becoming more proficient with protecting their custodial data, such as credit cards numbers and personal-identifying information. These factors point to a need by companies -- especially security firms -- to learn how to better protect their IP, he says.

"What is now required is for us to ask what kind of evolution and changes do we need to thwart those attackers who are more talented and more persistent," he says. "We can mock these companies for their mistakes -- or we can talk about the criminals and the perpetrators."

This article, "Hackers step up attacks on security firms [6]," was originally published at InfoWorld.com [7]. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog [8]. For the latest business technology news, follow InfoWorld.com on Twitter [9].

  a.. Data Management
  b.. Security
  c.. Intellectual Property
  d.. Cyber Crime
  e.. Malware
  f.. Network Security
  g.. Security Management

--------------------------------------------------------------------------------

Source URL (retrieved on 2011-03-25 05:08PM): http://www.infoworld.com/t/security-management/hackers-step-attacks-security-firms-803
Links:
[1] http://www.infoworld.com/t/authentication/weaknesses-in-ssl-certification-exposed-comodo-security-breach-593
[2] http://www.infoworld.com/d/security/emc-rsa-securid-info-swiped-sophisticated-hack-attack-917
[3] http://www.infoworld.com/d/security/hbgarys-hoglund-discusses-lessons-the-anonymous-hack-980
[4] http://www.infoworld.com/t/malware/stuxnet-attack-more-effective-bombs-888
[5] http://www.youtube.com/watch?v=JQEBYxp_vKs
[6] http://www.infoworld.com/t/security-management/hackers-step-attacks-security-firms-803?source=footer
[7] http://www.infoworld.com/?source=footer
[8] http://www.infoworld.com/blogs/infoworld-tech-watch?source=footer
[9] http://twitter.com/infoworld


_____________________________________________

Wayne A. Fox
1009 Karen Lane
PO Box 9421
Moscow, ID  83843

waf at moscow.com
208 882-7975
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.fsr.com/pipermail/vision2020/attachments/20110325/39ea9e8a/attachment-0001.html