Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

Large Businesses Wrestle With Web 2.0

New capabilities turn security policies and practices on end, panelists say

LAS VEGAS -- Interop 2008 -- If you have any doubts as to whether Web 2.0 technology is changing the nature of security in large organizations, we've got a couple of Garys for you.

Gary Hodge, executitve vice president at CTO at U.S. Bank, and Gary Dobbins, director of information security at the University of Notre Dame, appeared in a keynote panel session here this morning. Besides their first names, the two top security executives agreed on another point: Web 2.0 is seriously disruptive to security policy.

"After years of keeping them protected from the outside world, we're now exposing our internal systems to our customers; it totally changes the way we look at security," said Hodge, whose bank is the sixth-largest in the country. "Now, we have 3.5 million customers who are accessing our systems legitimately -- plus that group of bad guys who are trying to break in."

Aside from the huge problem of access control, U.S. Bank is dealing with the issues of mobile security that often accompany the move to Web 2.0. "It took us 10 years to get our employees to maintain a minimum of hygiene on their PCs," Hodge said. "Now we're not only dealing with employees, but with customers, and we're looking at iPhones and other mobile devices that may bring a whole rash of vulnerabilities."

In addition, Web 2.0 heightens the danger of insider threats, Hodge said. "We're now in a situation where we have to monitor what our employees are doing all day long. We need to know if their usage falls within normal patterns of behavior. We have to prove they don't have access to systems they shouldn't be able to access. I would say that today, I spend the bulk of my time on issues related to IT security."

U.S. Bank's approach to security is "very aggressive at the endpoints," said Hodge. The bank locks down USB ports, doesn't allow iPods, scans transmissions for credit card or other personal information, filters out potentially dangerous URLs, and logs and tracks usage information across the organization.

"If sensitive information shows up in the public domain, we want to know who lost it," he said.

The other Gary, Notre Dame's Dobbins, doesn't have the luxury of restricting user access across the enterprise. "There is a perception in the university environment that safe access isn't free access," he said. "It's like trying to operate a network for a whole city, but without network-based controls."

Notre Dame is tasked with facilitating the use of Web 2.0 applications across its campuses, but it must also protect the personal information of students, faculty, and employees, which have been breached or exposed at many other universities. As a result the home of the Fighting Irish has created a narrow "perimeter" that protects personal information and other sensitive data while making next-generation applications and services available to users whose PCs aren't controlled by the university.

"We've had to define a group of very granular controls and a system of layered protection that's necessitated by Web 2.0," Dobbins said.

The use of blogs, social networking, and next-generation technologies is "turning security on end," said Dmitri Alperovitch, director of intelligent analysis and hosted security at Secure Computing, which hosted the keynote panel. "The idea that any user can produce content is totally contrary to the old model. The browser is now the new operating system, but it was never designed for that."

"Securing the network at the perimeter used to work," said John McNulty, chairman and CEO of Secure Computing, who moderated the panel even after announcing his retirement last week. "That's not going to work anymore."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Secure Computing Corp. (Nasdaq: SCUR)

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Zero-Factor Authentication: Owning Our Data
    Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
    44% of Security Threats Start in the Cloud
    Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
    Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
    Robert Lemos, Contributing Writer,  2/20/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    6 Emerging Cyber Threats That Enterprises Face in 2020
    This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
    Flash Poll
    How Enterprises Are Developing and Maintaining Secure Applications
    How Enterprises Are Developing and Maintaining Secure Applications
    The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-8860
    PUBLISHED: 2020-02-22
    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S10 Firmware G973FXXS3ASJA, O(8.x), P(9.0), Q(10.0) devices with Exynos chipsets. User interaction is required to exploit this vulnerability in that the target must answer a phone call. ...
    CVE-2020-8861
    PUBLISHED: 2020-02-22
    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue...
    CVE-2020-8862
    PUBLISHED: 2020-02-22
    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from the...
    CVE-2020-9330
    PUBLISHED: 2020-02-21
    Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices (e.g., by using default credentials) can change the LDAP connection IP a...
    CVE-2020-9327
    PUBLISHED: 2020-02-21
    In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.