Lisa Vaas

WASHINGTON—There’s a bushel of security enhancements in Windows Vista—they comprise the most important aspect of the new operating system and the most compelling reason to upgrade, analysts say—but they’re not all perfect, nor are they silver bullets. Vista’s BitLocker encryption, for example, is restricted from working alongside virtualization software, doesn’t encrypt multiple disk volumes, and […]

WASHINGTON—On Dec. 15, 2005, the New York Times broke the news that soon after the Sept. 11 attacks President Bush had secretly authorized the National Security Agency to eavesdrop on U.S. citizens and other persons within the country. A Federal judge has since ruled that the NSA’s actions were both illegal and unconstitutional—a matter that […]

Microsoft is launching a slew of initiatives to help Web sites identify visitors. First, the company is kicking off four open-source projects to support the development of ID cards for online users. Microsoft is also releasing one of its identity management specs, Identity Selector Interoperability Profile, under its OSP (Open Specification Promise), meaning the specification […]

At Interop on May 22 McAfee unveiled an IPS that cranks up to 10G bps—good enough to cover 10GigE Ethernet and next-generation IPv6 networks, the company said. On an Interop day full of network security “we did it first’s” (IBM said its newly announced 6G bps intrusion prevention appliance can clean service provider pipes of […]

The American Federation of Government Employees is suing the Transportation Security Administration after the TSA lost a hard drive containing employment records for some 100,000 individuals. The union represents employees throughout the Department of Homeland Security, including the TSA. Its class action lawsuit, filed within a day of the TSA announcing the missing hard drive, […]

TJX: It’s the target of the largest known customer record theft of all time, and it’s a case in point that encryption is not a silver bullet. This is the heart of the encryption problem, quoted from the 10-K filing The TJX Companies made to the Securities and Exchange Commission: “Despite our masking and encryption […]

Way to go, vendors of low-end routers and intrusion detection and prevention systems—you’re a stumbling block on Bechtel’s path to the next-generation Internet. “We’re doing [both IPv4 and the next-generation IPv6 networks], and we anticipate doing both for a number of years,” said Fred Wettling, a Bechtel Fellow who manages technology standards and is sponsoring […]

Fortify Software has documented what the security firm is calling a “pervasive and critical” vulnerability in Web 2.0 applications—specifically, in the ability of an attacker to use a JavaScript vulnerability to steal critical data by emulating unsuspecting users. The vulnerability—which allows an exploit called JavaScript Hijacking—can be found in the biggest AJAX frameworks out there, […]

Expect to see the 2 billionth personal record compromised by year’s end, according to recent research from the University of Washington. But don’t blame it on rogue hackers; sorry to say, it’s your own fault, Corporate America. Researchers at the university in Seattle estimate that electronic records—those containing Social Security or credit card numbers, academic […]

ORLANDO, Fla.—Uh-oh, Sales has lost a laptop. The nightmare that ensues brings a host of uncertainties: Exactly what data was on that thing? How do you define nonpublic, private or confidential information? What constitutes a breach or a mass data compromise? What are your obligations to protect that data, and what are your organization’s obligations […]

The Securities and Exchange Commission said that its actions to freeze proceeds from a suspected high-tech pump-and-dump stock scheme and its suspension of stock trading on 35 companies touted in spam are two unrelated incidents. Others beg to differ. Dimitri Alperovitch, principal research scientist at Secure Computing, described such spamming and pump-and-dump schemes as part […]

The eBay villagers are whispering that he can creep through eBay’s internal databases and suck the lifeblood of customer accounts—log-ins and passwords—right out of their pulsing, 222 million-plus customer heart. He’s putting up bogus listings as fast as eBay can take them down, and that proves he’s walked through a security hole as big as […]