climate and comms

FIDO or Fast Identity Online was launched last week by a couple of Internet big hitters most notably PayPal.   They clearly have a vested interest in ensuring that their transactions are secure.     FIDO aims to provide specifications or standards to the industry that embody  an approach to authentication which starts to move away from the ‘security by obscurity ‘  or user name/password paradigm prevalent today.   The main reason why the incidence of hacking is sky-rocketing.   [ Twitter Hacked ] FIDO aims to leverage hardware devices such as phones and tablets as well as fingerprint readers, webcams, TPM ( Trusted Platform Module)  chips and tokens into an open-standard whereby there will be inter-operability between different systems but which comply to the standard.   A client/server architecture in combination with some hardware fingerprint starts to approach a much more secure approach th...

Mary Meeker informs us that there are now 1.1bn  Smartphones  (17% of all mobile phones) and these are driving Internet growth with a total of 2.4bn people now connected to the Internet. Mary Meeker Internet trends The universe for hackers just grows and grows.    One of the most lethal of these attacks is Zeus (ZITMO) – which is aimed squarely at Smartphones. The Zeus attack is an example of several attacks now being launched that are based wholly on anticipated behavior, especially as it relates to social media, single-sign-on and BYOD. A sophisticated Zeus campaign stole an estimated €36 million, or $47 million, from over 30,000 customers across more than 30 banks in Europe this summer. The Eurograbber campaign, as it has been named, used custom versions of Zeus and Zeus in the mobile (ZITMO) Trojans to bypass the two-factor authentication measures to compromise customer bank accounts, Darrell Burkey, director of IPS products at Check Point Software Te...

Whether in the 'real' world or the Cyber world there are real threats and dangers and there are perceived threats and dangers.   Sandy has just taught us about the reality of the force of nature when an extreme event occurs.    Destruction has been wrought on an unprecedented scale.  While we know that physical harm can be effected through  cyber-terrorism/war such as Stuxnet – the reality is that the hype about Cyber war is just that – hype.   These events, like Sandy, are rare.   I contend that the sources of much of the scare-mongering  (about the ‘threat’ of Cyberwar )  are more often than not , entities/organizations/newspapers / journals that have a vested interest in the proliferation of FUD about the weakness of our Cyber defences.    Don’t get me wrong – I am just as concerned as the next guy about cyber security – all I am saying is – lets get some perspective on the matter.   The defences that were put up again...

Finally it seems … the penny has dropped.   Passwords are a poor substitute for real online security.   There is more and more ‘chatter’ about it.    Robin Henry writing in the Sunday Times on New Years Day talks of the end of ‘password hell’ invoking solutions in the pipeline from the Web Gods – Apple and Google.  The talk is of new biometric solutions such as facial and hand movement recognition.  Even IBM is talking this way.  ( http://www.forbes.com/sites/thestreet/2011/12/20/ibms-tech-predictions-for-the-next-5-years/ )  I agree with the notion that passwords are a dying breed but not that biometrics will become vogue.   They are fraught with problems of their own such as reliability, accuracy and the need for referencing of data-bases ( fail !) .    Why are passwords defunct?   Basically they are difficult to remember and they are easy to steal.    The solutions needed are those that require no cognitive l...

There are so many pundits out there who have finally jumped on this bandwagon.   But lets be honest,  five and a half (or is it now closer to six)  billion people,  can’t be wrong – the mobile revolution is finishing its transition from what have been predominantly voice services to broad-band data services.  The devices that we used to just talk on are now full blown computers and we use them for everything – although we do actually still use them to talk on as well too!.  ( See my previous blog:   http://rossmac2310.blogspot.com/2011/10/human-evolution-and-mobile.html ) There are so many exciting threads to this trend : the Internet revolution in Africa and other emerging markets,  the plethora of new services being created every day that add value to our everyday existence and the emergence of real competition in the mobile handset space.   I applaud Microsoft ( and Nokia) for their exciting new partnership and a handset t...

We in the southern part of the UK have started to see our Indian summer start to slowly fade as we get into this first week of October.    It has been a wonderful but disorientating week with temperatures in the high 20’s (80’s F) – and clear blue skies - I could have sworn this was Jo’burg in Summer.   All that was missing was the swimming pools ! Well I know that parts of the mid-West have also had some great weather.  Indeed in the good ol’  US of A October has become known as  National Cyber Security Awareness month.    Who would have thought ten years ago that a whole month would be ‘honoured’ with such a strange moniker.     Well I guess 10 years ago no one would have predicted that we would have become so utterly dependent on the Web – our every waking and in some instances sleeping moments have some Web connection.    E-mail, social-media,  telephony,  shopping, business, entertainment, gaming  – ju...

I know,   I know – I hear the howls of protest even before finishing this first sentence.   “What about all the innocent lives exposed by the irresponsible publication of peoples names in positions of authority or in sensitive roles. ?”    But where does the fault lie ?  With those doing the breaking and entering?   Or those not providing adequate protection??  It is liked leaving your house locked without an alarm system, going on holiday, and coming back and finding it broken into.   Don’t be surprised.  You have no one to blame but yourself.  “ But these are criminals ! “  – I hear the sounds of self righteous chest thumping.    Maybe, but what they have done – I hope – is scare the s**t out of anyone who has anything (data) that is accessible via the Web  - and into ensuring that their ‘security’ ( if any ) - is rapidly upgraded.    This ranges from personal users who ...

 A large ( big 4 )  UK bank recently sent its corporate customers a letter advising them of their  ‘new’ security solution.   Here is an extract from the letter : " Online banking fraud and identity theft is increasing across the UK - in 2009 fraud across all UK banks exceeded £59m.  Fraudsters are becoming ever more sophisticated in their efforts to obtain personal information and gain access to accounts.  We're committed to keeping your Internet Banking service safe, so we're introducing a more secure way to bank online using a card reader.  A card reader is a small handheld device which you will need every time you bank online.  We'll send one to every registered user within your business.   " Talk about being underwhelmed.  If I was a customer I would be seriously unhappy.   But most  customers probably will not.  That is because they (probably)  don’t realize that :  1)    THEY are g...

  So there I was on the phone to an Analyst today explaining (at a fairly high level )   some of the basic features of LiveEnsure TM   when he says – “   ahh – I get it – this is identical to Bank of America’s SiteKey/Site Pass system .”    Not having the details of said banks system at my fingertips – I was unable to correct the Analyst on his incorrect conclusion with any hard science.    We were also running out of time,   it was a bad line and…all I could say was – it is not the same – there is much,   much more going on under the hood with LiveEnsure TM .     So why is BofA’s SiteKey TM / Site Pass TM authentication system NOT identical to LiveEnsure TM   ? ·                 Device ID.    Although both ostensibly have a ‘hardware device recognition’ component – the BofA solution relies upon the re-referencing of a cookie (dow...

Experts from Gartner have said that the recent 'froth' of M&A activity in the security space does not constitute a 'trend'.   While 'one swallow does not a summer make'  I would contend that this is in fact a trend and that it set to hold for at least another year.   Why? Well first of all the 'froth' was in fact more like a large set of Atlantic rollers breaking on the Cape coast!!!  Consider the number of deals that have taken place in the last 6 months ( see previous blog) crowned by the recent announcement by HP of its acquisition of Arcsight for $1.5bn. "   Hewlett-Packard  has agreed to buy high-end technology security company ArcSight for $1.5bn to profit from its customers’ increasing concerns about  protecting their data from hackers . The cash offer of $43.50 a share for Silicon Valley neighbour ArcSight was more than 50 per cent above where the company was trading before reports last month that it was courting buyers. It value...

The tech sector and in particular the security sector within  has been extremely active during the past 6 months.  There have been numerous acquisitions that indicate an increased appetite for quality security assets.    Perhaps the most high profile of these was the recent acquisition of MacAfee by Inte l ( a $7.8bn transaction ) representing a premium of over 50% to the then prevailing market price.  A PE multiple of about 48 and 3.8 x Revenue. This was Intel’s largest ever acquisition. Symantec acquired Verisign’s Authentication business for $1.28bn - approximately 4 x revenues. (Second quarter revenues from this Unit was about $100m )  ( May ) ; CA has announced it will acquire Arcot systems for $200m in Q4 2010.  Arcot provides Identity Access Management and Authentication products  ( www.ca.com/www.arcot.com ) ;  VMWare has announced it will acquire Integrien and TriCipher .  (Sep)  HP has just announced it will acquire ...

I found this article at www.smallbusinesscomputing.com and I am repeating it here verbatim because I believe that it captures the essence of the challenges that lie ahead and the need for education and the provision of simple but effective authentication solutions.  What SMBs Don't Know About Security Can Hurt You April 23, 2010 Small and midsized businesses might be the lifeblood of the U.S. economy, but according to the latest Internet security survey from Panda Security, their generally lackadaisical efforts to protect consumer data is also making them a prime target for cyber thieves. More disturbing, particularly for customers swiping their credit cards or purchasing products and services online, the survey reveals that the vast majority of SMBs claim they don't know how to effectively prevent identity theft, lack the resources to install the technology that could thwart the majority of cyber attacks and, worse, seem to believe that it's really not their probl...

With over two billon Internet users and five billon mobile phone users these global networks bring people ever closer together. These technologies which include broadband (terrestrial) and 3G (wireless) allow for more and more data to be carried. We have entered the next Tech Cycle which is called the Mobile Internet. It was preceded by four tech cycles starting in the 1960’s with the Mainframe cycle. Approximately every decade thereafter we have had a new cycle; Mini-computers - 70’s; PC’s - 80’s and desktop Internet - 90’s. The Mobile Internet cycle triggered by the launch of the iPhone will see mobile internet access overtake fixed access by 2014. This will be driven by smart phone take up and 3G/4G rollout. We are already at the critical point of over 1bn 3G users. Other drivers are video ( YouTube); Social networking (Facebook) and VOIP. Much of this take up is occurring in emerging markets; there are 5 babies born every second - but there are 30 new mobile ph...

If you found my previous post somewhat disconcerting then have a look at this link which is the UK Information Commissioners Guide to the new legislation. " The code explains how the Data Protection Act applies to the collection and use of personal data online. It also provides good practice advice for organisations that do business online and are therefore subject to the DPA. " http://www.ico.gov.uk/ebook/ebook.htm and if you want more in depth information about the legislation itself then have a look at this video from Stewart Room. It makes it somewhat more accessible.

So how do you value your privacy in the Facebook age ? Does it matter to you that the calls you make, the emails you send, your credit card transactions, the Internet sites you visit, the images of you travelling to work, your social networking posts are now stored at data centres in the Cloud and retrievable by myriad marketers, Government agencies and companies ? None of whom you ever entrusted with your information in the first place. Your digital footprint is a permanent record of your every move. Data is the pollution of the Information age. Everything we do generates data, and a secondary spin-off of Moores law is that every year it gets cheaper to store and process this data. So rather than sort through our e-mails and delete the ones we don’t need – we just keep them all – it is easier and cheaper to do so. The same thing happens with all of our data now. Most of ‘your’ data actually belongs to someone else. All of your G-mails, everything you ...

I suppose what I am really excited about - ( notwithstanding the doom-mongers of Global Warming, un-payable National debt, Euro-zone contagion, GM food and England’s prospects in the World Cup amongst other paranoia permeating and eating away at the soul of our society !! ) - is the fact that we have entered the next Tech Cycle. Amidst the threat of a double dip recession, oil spills in the Gulf of Mexico and Greek unrest who cares about the next Tech Cycle – the next Dot Bomb ? You may well ask ! The fact is that there have been four Tech cycles in the last 50 years and each one has been bigger and better than the preceding one. Let's remind ourselves of what they were : 1. The mainframe computing cycle started in the 60’s with the main players being IBM, NCR, Sperry ; then followed 2. The mini-computing cycle in the 70’s with the major companies being Digital Equipment, HP and Wang and then; 3. The PC era of the 80’s/90’s where we saw the rise ...

It is now time to think BIG. About the MACRO picture. How the massive growth in INFRASTRUCTURE continues unabated and how it will impact on you and me. Our lives are slowly adapting/evolving because of the availability of more and more BANDWIDTH, faster PROCESSING speeds and the increasing ubiquity of WIRELESS networks – both GSM and WIFI. How are we changing the way we behave? You just need to look at two markers – 1.) MOBILE phone growth especially in emerging markets ( there will be almost 5bn mobile phone users by the end of 2010) and 2.) growth in SOCIAL media especially the likes of FACEBOOK (400m users and growing ) which takes up an inordinate amount of our spare and working time. People are increasingly connected in an ALWAYS ON ALWAYS CONNECTED WORLD. The curse of the CRACKBERRY has now been extended to all SMART phone users. We have become slaves to technology. Almost every human interaction whether work or play is increasingly reliant upon ...

I am back and this is a hot off the press news piece that I believe is so important I have to share 'verbatim' - I got this off the PC Advisor website today. This whole issue of authentication and related security is put into context in light of this alarm bell from Michael Dell. He is singing my mantra.   It is self-explanatory and should highlight how seriously we should be taking cybercrime and coming up with solutions that are effective and scalable. ' Cybersecurity needs a global rethink, and fast, Dell's CEO Michael Dell and Services CIO, Jim Stikeleather, have warned experts at the EastWest Institute Worldwide Cybersecurity Summit in the US. In separate presentations and briefings, the men developed the theme of piecemeal reactions to the rapid rise of cyber-criminality, which included economic crime and direct threats to critical infrastructure. The message was unusually blunt. Governments haven't done enough and have fallen into the trap of se...