<?xml version="1.0" encoding="iso-8859-1"?><!-- Copyright (C) 1996-2012 - CIOINSIGHT.COM -->
<rss version="2.0">
<channel>
<title>Security - RSS Feed</title>
<link>http://www.cioinsight.com</link>
<description>Security news - RSS Feed</description>
<language>en-us</language>
<lastBuildDate>Mon, 13 Feb 2012 14:47:56 -0500</lastBuildDate>
<pubDate>Mon, 13 Feb 2012 14:47:56 -0500</pubDate>
<item><title>The State of Security: Malware Rises as the Era of Spam Ends</title>
<pubDate>Thu, 26 Jan 2012 09:22:49 -0500</pubDate>
<link>http://www.cioinsight.com/c/a/Security/The-State-of-Security-Malware-Rises-as-the-Era-of-Spam-Ends-392019/?kc=rss</link>
<description><![CDATA[When it comes to preventing increasingly sophisticated and malicious attacks to your corporate network and its data, simply slapping on a few security appliances and scanning for spam isn't enough. Hackers act fast and are changing tactics. Even more can be gained by taking the time to analyze the data that your tools can give you about the attacks your enterprise is thwarting – or the malware that makes its way through. Analysis can give CIOs and IT managers value information about what's working and what's not when it comes to security. In the Cisco 4Q11 Global Threat Report, the company has rounded up information gathered by its security products to create a picture of the state of cyber-security between Oct. 1 and Dec. 31, 2011. The report finds that while spam volume continues to decline, malware attacks are becoming more frequent; in fact, &quot;33% of Web malware encountered was zero-day malware not detectable by traditional signature-based methodologies at the time of encounter,&quot; Cisco said. &quot;Most importantly, regular review and understanding of the data can help uncover the elusive “black swan” the types of surreptitious and malicious events that otherwise could fly below the radar.&quot; Here are the report's key findings.   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/The-State-of-Security-Malware-Rises-as-the-Era-of-Spam-Ends-392019/?kc=rss</guid>
</item>
<item><title>Cloud Security Survey Reveals Gap Between IT, Compliance Officers </title>
<pubDate>Wed, 23 Nov 2011 10:31:24 -0500</pubDate>
<link>http://www.cioinsight.com/c/a/Security/Cloud-Security-Survey-Reveals-Gap-Between-IT-Compliance-Officers-331339/?kc=rss</link>
<description><![CDATA[A study by the Ponemon Institute, sponsored by security technology vendor Vormetric Inc., shows that less than half of the 1,018 U.S.-based IT security practitioners and compliance officers surveyed think their organizations have adequate technology in place to secure their cloud computing infrastructures. The two groups of executives IT security and compliance disagree sharply on whether the cloud is as secure as on-premise data centers. They also have differing opinions on who is responsible for cloud data security and what security measures companies should use. Ponemon Institutes report, “Data Security in the Cloud Survey of U.S. IT Operations, IT Security and Compliance Practitioners,” surveyed the executives online over a three-week period ending in October 2011. “While we were surprised by the different attitudes towards cloud security among IT practitioners and compliance officers, the findings did reveal that security in the cloud is a concern for both groups, especially in IaaS environments,” says Larry Ponemon, chairman and founder of the Ponemon Institute. What is most troubling, Ponemon says, is that while respondents feel they lack adequate technologies to secure their cloud environments, ownership of security in the cloud is dispersed throughout the organization.   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/Cloud-Security-Survey-Reveals-Gap-Between-IT-Compliance-Officers-331339/?kc=rss</guid>
</item>
<item><title>How Data Breaches Can Affect Brand and Reputation </title>
<pubDate>Wed, 16 Nov 2011 11:12:34 -0500</pubDate>
<link>http://www.cioinsight.com/c/a/Security/How-Data-Breaches-Can-Affect-Brand-and-Reputation-888678/?kc=rss</link>
<description><![CDATA[The damage experienced by a company in the wake of a data breach can have a lasting negative impact on brand equity and reputation. How lasting? An online survey of 843 executives in the U.S. conducted by the Ponemon Institute and sponsored by security technology provider Experian Data Breach Resolution shows that it takes about one year, on average, to restore an organizations reputation. In addition to the time and energy it takes to rectify the situation, a data breach has the potential to severely affect a companys brand equity over the long term, according to the report. Depending on the type of information lost as a result of the breach, the average damages to the value of the brand ranged from $184 million to more than $330 million.   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/How-Data-Breaches-Can-Affect-Brand-and-Reputation-888678/?kc=rss</guid>
</item>
<item><title>Social Media, Cloud Create Information Security Challenges</title>
<pubDate>Fri, 11 Nov 2011 11:36:17 -0500</pubDate>
<link>http://www.cioinsight.com/c/a/Security/Social-Media-Cloud-Create-Information-Security-Challenges-801344/?kc=rss</link>
<description><![CDATA[In the rush to move into cloud computing, deploy mobile devices and leverage social media, a growing gap is developing between organizations business needs and their ability to tackle new and complex security threats, according to Ernst &amp; Young LLPs 14th annual Global Information Security Survey. Although 72 percent of the 1,700 worldwide IT and security executives surveyed see increasing levels of risk due to external threats, and more companies are likely to adopt mobile tablet usage, security implementation is still low, the report says. Only about one third of respondents, surveyed online between June and August 2011, have updated their information security strategies in the past 12 months. “Information security is one of the most important issues companies face today, and strategies need to be refined to adjust to an ever-changing environment and resulting security risks,” says Bernie Wedge, Americas IT risk and assurance leader at Ernst &amp; Young. “Mobility and networking are here to stay. The best-protected companies are those that are proactive, detecting and managing minor issues before they become major incidents, and for many companies, this means the current mindset needs to change from a focus on short-term fixes to a holistic, strategic approach.”   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/Social-Media-Cloud-Create-Information-Security-Challenges-801344/?kc=rss</guid>
</item>
<item><title>Information Security Strategies Found Lacking: PwC</title>
<pubDate>Wed, 05 Oct 2011 11:54:49 -0400</pubDate>
<link>http://www.cioinsight.com/c/a/Security/Information-Security-Strategies-Found-Lacking-PwC-322139/?kc=rss</link>
<description><![CDATA[A large number of global companies think they have an effective information security strategy in place and are proactively executing their security plans, according to a new survey by consulting firm PricewaterhouseCoopers LLP (PwC). But a relatively small percentage of the organizations surveyed (13%) are what the firm calls true information security “leaders.” The PwC 2012 Global State of Information Security Survey, in which more than 9,600 business and IT executives worldwide were surveyed online between February and April 2011, finds that companies are actively investing in information security, driven by a quickly evolving and dangerous landscape of cyber threats, according to PwC. “The face of cyber threats has rapidly evolved from curious college kids taking their hand at hacking to an enormous global ecosystem of cyber-crime,” says Mark Lobel, principal at PwC and co-author of the study. “Companies need a comprehensive approach to security--technology, education and awareness--and a very small number have truly mastered all three.”   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/Information-Security-Strategies-Found-Lacking-PwC-322139/?kc=rss</guid>
</item>
<item><title>10 Things CIOs Don't Know About Cyber Security</title>
<pubDate>Mon, 12 Sep 2011 12:52:01 -0400</pubDate>
<link>http://www.cioinsight.com/c/a/Security/10-Things-CIOs-Dont-Know-About-Cyber-Security-588172/?kc=rss</link>
<description><![CDATA[What you don't know about IT security could hurt you -- and your company. According to Symantec's 2011 State of Security Survey, IT security is the biggest risk companies face, ranking ahead of the theft of physical goods, terrorism and natural disasters. Mobility, social media and good old-fashioned hackers remain the biggest cyber threats. How can companies best mitigate these threats and keep their employees and their data safe from attack? Here, we highlight 10 survey findings to help you decide how your company stacks up against your peers. The survey was conducted in April and May 2011 by Applied Research on behalf of Symantec. Applied Research received survey responses from 3,300 executives in 36 countries, including C-level professionals, strategic and tactical IT executives, and individuals in charge of IT resources.   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/10-Things-CIOs-Dont-Know-About-Cyber-Security-588172/?kc=rss</guid>
</item>
<item><title>Breach Notification: Time for a Wake Up Call</title>
<pubDate>Fri, 02 Sep 2011 13:03:07 -0400</pubDate>
<link>http://www.cioinsight.com/c/a/Security/Breach-Notification-Time-for-a-Wake-Up-Call-581657/?kc=rss</link>
<description><![CDATA[The scope of information that requires public disclosure in the event of a data breach is growing exponentially. For example, an email address that is verified as associated with a particular business is infinitely more valuable to phishing scammers than an email address and a guess. CIOs now have the unenviable task of discussing a broad range of data losses with legal, marketing and risk assessment professionals.   -  In case you haven't heard, the days of having no obligation to notify consumers of a data breach or loss that involves only email addresses may have ended. This should be a major wakeup call for every CIO.
Historically, a business and its CIO were only required to be concerned about personally iden...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/Breach-Notification-Time-for-a-Wake-Up-Call-581657/?kc=rss</guid>
</item>
<item><title>Mobile Security Suffers a Crisis of Confidence</title>
<pubDate>Thu, 01 Sep 2011 16:39:35 -0400</pubDate>
<link>http://www.cioinsight.com/c/a/Security/Mobile-Security-Suffers-a-Crisis-of-Confidence-344025/?kc=rss</link>
<description><![CDATA[Many organizations lack confidence in their ability to properly manage access &amp;#8232;to sensitive information when users connect via the cloud or on mobile&amp;#8232; devices and laptops, according to a survey by Courion, a provider of identity and access management technologies. The company conducted an online survey of 988 IT&amp;#8232; decision makers at large enterprises worldwide in June and July 2011. Courion notes that the findings are “especially troubling, given the growing popularity of consumer&amp;#8232; devices.” Two out of every three large enterprises report that they have employees who are connecting their own personal mobile devices o&amp;#8232;n the corporate network, and yet more than one out of every five organizations&amp;#8232; does not have a policy in place to govern this use, or is not even aware If &amp;#8232;a policy exists. The survey results indicate that enterprises are fairly &amp;#8232;confident that they can assure appropriate user access to resources&amp;#8232; on-premise, but they become much less confident when users connect via the cloud&amp;#8232; or on mobile devices or laptops.   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/Mobile-Security-Suffers-a-Crisis-of-Confidence-344025/?kc=rss</guid>
</item>
<item><title>Security and the Consumerization of IT</title>
<pubDate>Thu, 23 Jun 2011 11:44:20 -0400</pubDate>
<link>http://www.cioinsight.com/c/a/Security/Security-and-the-Consumerization-of-IT-640152/?kc=rss</link>
<description><![CDATA[The “consumerization” of IT remains a hot topic for technology executives, with the growing popularity of products such as the Apple iPad and social networking sites such as Facebook and Twitter. So how secure are these consumer-focused technologies that are increasingly pushing their way into the work environment, and what impact are they having on corporate compliance efforts? Proofpoint Inc., a provider of cloud-based email security offerings, and research firm Osterman Research, conducted an online survey of 632 IT and security professionals from U.S. businesses and government agencies in May 2011 to find out. The results are featured in the &quot;2011 Consumerized IT Security Survey,&quot; released on June 23. According to the report, this is an issue many organizations need to think about: more than 80 percent of those surveyed are letting their employees use consumerized IT products and services to conduct business communications. “Consumerized IT in the workplace is a fact of life, and organizations recognize that they must act to integrate it in a secure and compliant manner,” says Michael Osterman, principal of Osterman Research.   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/Security-and-the-Consumerization-of-IT-640152/?kc=rss</guid>
</item>
<item><title>Self-Encrypting Drives: The Secret to Security? </title>
<pubDate>Thu, 16 Jun 2011 11:28:29 -0400</pubDate>
<link>http://www.cioinsight.com/c/a/Security/SelfEncrypting-Drives-The-Secret-to-Security-867112/?kc=rss</link>
<description><![CDATA[A study from the Ponemon Institute puts statistics behind something you may already know: That self-encrypting drives are integral to the safety of your corporate data. The study, &quot;Perceptions About Self-Encrypting Drives: A Study of IT Practitioners,&quot; was commissioned from Ponemon by Trusted Computing Group, a provider of open-standard computing technologies. Companies that employ such drives are far more likely to save themselves from potential breaches than those that choose not to use such hardware, according to the report. If you arent familiar with self-encrypting drives, the devices encrypt corporate data automatically and on a continuous basis to ensure information is not unnecessarily left open to potential threats. Self-encrypting drives become all the more useful when one considers that 40% of employees admit to turning off software encryption services without considering the security impact of doing so. In order to gauge the importance of self-encrypting drives in the enterprise, Ponemon Institute surveyed 517 U.S. T workers in the financial services, retail, healthcare, and technology sectors. The survey also reveals some frightening stats on how many respondents have experienced a data breach.   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/SelfEncrypting-Drives-The-Secret-to-Security-867112/?kc=rss</guid>
</item>
<item><title>Mobile Malware Threats On the Rise</title>
<pubDate>Mon, 13 Jun 2011 11:04:26 -0400</pubDate>
<link>http://www.cioinsight.com/c/a/Security/Mobile-Malware-Threats-On-the-Rise-479654/?kc=rss</link>
<description><![CDATA[For a long time, the greatest threat to your companys security was in the form of desktop-based malware. Cybercriminals around the world create programs and other malicious services that can wreak havoc on your network and steal important data. With the growing use of mobile devices in the enteprise, a new threat is emerging. Not only do you need to worry about devices being stolen, but malware on mobile products is becoming a growing issue. Googles Android operating system, Symbian, and even iOS are all bigger targets than ever for cybercriminals. That was made abundantly clear in McAfees 1Q 2011 Threats Report, which reveals that mobile threats are on the rise. And you need to be prepared before trouble erupts. Read on to find out about the current state of mobile malware and how these trends might impact you and your company going forward.   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/Mobile-Malware-Threats-On-the-Rise-479654/?kc=rss</guid>
</item>
<item><title>SideXSide: Symantec Endpoint Protection Vs. McAfee Total Protection</title>
<pubDate>Thu, 09 Jun 2011 18:14:52 -0400</pubDate>
<link>http://www.cioinsight.com/c/a/Security/SideXSide-Symantec-Endpoint-Protection-Vs-McAfee-Total-Protection-528120/?kc=rss</link>
<description><![CDATA[Recent hacks into defense contractors Lockheed Martin and Northrup Grumman, Zeus malware riding in on faux LinkedIn messages, and recent data breaches at major organizations including Sony, Epislon, and the Massachussetts Unemployment Office may have you busily researching your security options. To help you out, weve focused this SideXSide comparison on two specific solutions -- Symantecs Endpoint Protection and McAfees Total Protection.   -  Recent hacks into defense contractors Lockheed Martin and Northrup Grumman, Zeus malware riding in on faux LinkedIn messages, and recent data breaches at major organizations including Sony, Epislon, and the Massachussetts Unemployment Office may have you busily researching your security options.

...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/SideXSide-Symantec-Endpoint-Protection-Vs-McAfee-Total-Protection-528120/?kc=rss</guid>
</item>
<item><title>Corporate Software Piracy: 10 Fast Facts</title>
<pubDate>Wed, 08 Jun 2011 18:56:50 -0400</pubDate>
<link>http://www.cioinsight.com/c/a/Security/Corporate-Software-Piracy-10-Fast-Facts-172195/?kc=rss</link>
<description><![CDATA[Pirated software poses a huge risk for corporations, according to a report from the Business Software Alliance (BSA). Getting corporate users to download malicious programs is one of the most surefire ways for hackers to gain access to your network. Some of these threats come in the form of malware, while others pretend to be innocuous programs. According to the BSA, an anti-piracy organization, businesses in six states were responsible for nearly half of all alleged cases of corporate software piracy in the U.S. BSA receives tips from IT personnel and other knowledgeable sources through its online reporting form. “The trend underscores how prevalent these harmful copyright violations are throughout the US economy,” says Jodie Kelley, the BSAs Vice President of Anti-Piracy and General Counsel. The overall software piracy rate in the United States was 20 percent in 2010, according to the BSA-IDC Global Software Piracy Study, and its commercial value was nearly $9.5 billion. BSA offers companies a state-of-the-art training course and certification program called SAM Advantage, which teaches them how to avoid piracy in the first place by better managing their software tools as strategic assets. The course helps companies understand how to capture greater business value from their software assets while increasing efficiency and avoiding security risks and legal jeopardy.   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/Corporate-Software-Piracy-10-Fast-Facts-172195/?kc=rss</guid>
</item>
<item><title>Cyber Crime Trends Report: Grim News for Q1 2011</title>
<pubDate>Tue, 17 May 2011 08:27:10 -0400</pubDate>
<link>http://www.cioinsight.com/c/a/Security/Cyber-Crime-Trends-Report-Grim-News-for-Q1-2011-851053/?kc=rss</link>
<description><![CDATA[An uptick in phishing attacks, a lack of domain name service security awareness among IT personnel, and an increase in mobile attacks are among the findings of IID's &quot;eCrime Trends Report, First Quarter 2011.&quot; IID is a vendor of anti-phishing solutions.  Many in the information security industry have been focused on Advanced Persistent Threats (APT) during the past several months, according to the report. The typical “low and slow” approach is often pointed out as a popular tactic for cyber criminals who are targeting systems at large organizations. As a result of the HBGary Federal breach, it has been discovered that enterprises such as Johnson and Johnson and Dow Chemical have been targets of hackers, as was the law firm King &amp; Spalding. Like the attack against HBGary Federal, the breach of RSAs SecurID Security two-factor Authentication product in March 2011 shows that threats really can penetrate and disrupt even those businesses that focus on IT security, according to the report. More than 25,000 organizations worldwide use the SecurID product. These events illustrate how cyber criminals are focusing on particular aspects of the Internet business ecosystem and not just haphazardly guessing at which organizations to target. In the plus column, Microsoft, McAfee, Fireye and other security researchers worked with U.S. Federal law enforcement to take down the Rustock botnet.   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/Cyber-Crime-Trends-Report-Grim-News-for-Q1-2011-851053/?kc=rss</guid>
</item>
<item><title>Microsoft Security Vulnerability Report: How to Mitigate Risk</title>
<pubDate>Tue, 26 Apr 2011 13:15:49 -0400</pubDate>
<link>http://www.cioinsight.com/c/a/Security/Microsoft-Security-Vulnerability-Report-How-to-Mitigate-Risk-729231/?kc=rss</link>
<description><![CDATA[A report from security vendor BeyondTrust gives us an aggregated overview of the number and type of security vulnerabilities reported in 2010 by Microsoft and its partners. BeyondTrust's 2010 Microsoft Vulnerability Report indicates that removing administrator rights from employee PCs can go a long way toward securing your company from some of the most prevalent threats in the wild. BeyondTrust, a vendor of identity management solutions, explains the methodology behind its conclusions, which are based on the security vulnerabilities in Microsoft software that are regularly identified by Microsoft and its partners. According to BeyondTrust, in 2010 Microsoft published more than 100 security bulletins documenting and providing patches for 256 vulnerabilities. BeyondTrust analyzed all of the published Microsoft vulnerabilities in 2010. The report also examined all of the published Windows 7 vulnerabilities from the time that operating system was introduced in October 2009 through December 2010. This report uses information found in the Individual Security Bulletins to classify vulnerabilities by the following criteria: severity rating; vulnerability impact; and affected software. The report considers a vulnerability capable of being mitigated by removing administrator rights if the following sentence is located in the Security Bulletins Mitigating Factors section: “Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.”   -  ...]]></description>
<guid>http://www.cioinsight.com/c/a/Security/Microsoft-Security-Vulnerability-Report-How-to-Mitigate-Risk-729231/?kc=rss</guid>
</item>
</channel>
</rss>

