Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

Large Businesses Wrestle With Web 2.0

New capabilities turn security policies and practices on end, panelists say

LAS VEGAS -- Interop 2008 -- If you have any doubts as to whether Web 2.0 technology is changing the nature of security in large organizations, we've got a couple of Garys for you.

Gary Hodge, executitve vice president at CTO at U.S. Bank, and Gary Dobbins, director of information security at the University of Notre Dame, appeared in a keynote panel session here this morning. Besides their first names, the two top security executives agreed on another point: Web 2.0 is seriously disruptive to security policy.

"After years of keeping them protected from the outside world, we're now exposing our internal systems to our customers; it totally changes the way we look at security," said Hodge, whose bank is the sixth-largest in the country. "Now, we have 3.5 million customers who are accessing our systems legitimately -- plus that group of bad guys who are trying to break in."

Aside from the huge problem of access control, U.S. Bank is dealing with the issues of mobile security that often accompany the move to Web 2.0. "It took us 10 years to get our employees to maintain a minimum of hygiene on their PCs," Hodge said. "Now we're not only dealing with employees, but with customers, and we're looking at iPhones and other mobile devices that may bring a whole rash of vulnerabilities."

In addition, Web 2.0 heightens the danger of insider threats, Hodge said. "We're now in a situation where we have to monitor what our employees are doing all day long. We need to know if their usage falls within normal patterns of behavior. We have to prove they don't have access to systems they shouldn't be able to access. I would say that today, I spend the bulk of my time on issues related to IT security."

U.S. Bank's approach to security is "very aggressive at the endpoints," said Hodge. The bank locks down USB ports, doesn't allow iPods, scans transmissions for credit card or other personal information, filters out potentially dangerous URLs, and logs and tracks usage information across the organization.

"If sensitive information shows up in the public domain, we want to know who lost it," he said.

The other Gary, Notre Dame's Dobbins, doesn't have the luxury of restricting user access across the enterprise. "There is a perception in the university environment that safe access isn't free access," he said. "It's like trying to operate a network for a whole city, but without network-based controls."

Notre Dame is tasked with facilitating the use of Web 2.0 applications across its campuses, but it must also protect the personal information of students, faculty, and employees, which have been breached or exposed at many other universities. As a result the home of the Fighting Irish has created a narrow "perimeter" that protects personal information and other sensitive data while making next-generation applications and services available to users whose PCs aren't controlled by the university.

"We've had to define a group of very granular controls and a system of layered protection that's necessitated by Web 2.0," Dobbins said.

The use of blogs, social networking, and next-generation technologies is "turning security on end," said Dmitri Alperovitch, director of intelligent analysis and hosted security at Secure Computing, which hosted the keynote panel. "The idea that any user can produce content is totally contrary to the old model. The browser is now the new operating system, but it was never designed for that."

"Securing the network at the perimeter used to work," said John McNulty, chairman and CEO of Secure Computing, who moderated the panel even after announcing his retirement last week. "That's not going to work anymore."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Secure Computing Corp. (Nasdaq: SCUR)

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    HackerOne Drops Mobile Voting App Vendor Voatz
    Dark Reading Staff 3/30/2020
    Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
    Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Current Issue
    6 Emerging Cyber Threats That Enterprises Face in 2020
    This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
    Flash Poll
    State of Cybersecurity Incident Response
    State of Cybersecurity Incident Response
    Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-17230
    PUBLISHED: 2020-04-03
    includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
    CVE-2019-17231
    PUBLISHED: 2020-04-03
    includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
    CVE-2020-10689
    PUBLISHED: 2020-04-03
    A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access to the workspace pods of another user. Successful exploitation requires knowledge of the service name ...
    CVE-2020-10960
    PUBLISHED: 2020-04-03
    In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler...
    CVE-2020-11500
    PUBLISHED: 2020-04-03
    Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Within a meeting, all participants use a single 128-bit key.