Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

Large Businesses Wrestle With Web 2.0

New capabilities turn security policies and practices on end, panelists say

LAS VEGAS -- Interop 2008 -- If you have any doubts as to whether Web 2.0 technology is changing the nature of security in large organizations, we've got a couple of Garys for you.

Gary Hodge, executitve vice president at CTO at U.S. Bank, and Gary Dobbins, director of information security at the University of Notre Dame, appeared in a keynote panel session here this morning. Besides their first names, the two top security executives agreed on another point: Web 2.0 is seriously disruptive to security policy.

"After years of keeping them protected from the outside world, we're now exposing our internal systems to our customers; it totally changes the way we look at security," said Hodge, whose bank is the sixth-largest in the country. "Now, we have 3.5 million customers who are accessing our systems legitimately -- plus that group of bad guys who are trying to break in."

Aside from the huge problem of access control, U.S. Bank is dealing with the issues of mobile security that often accompany the move to Web 2.0. "It took us 10 years to get our employees to maintain a minimum of hygiene on their PCs," Hodge said. "Now we're not only dealing with employees, but with customers, and we're looking at iPhones and other mobile devices that may bring a whole rash of vulnerabilities."

In addition, Web 2.0 heightens the danger of insider threats, Hodge said. "We're now in a situation where we have to monitor what our employees are doing all day long. We need to know if their usage falls within normal patterns of behavior. We have to prove they don't have access to systems they shouldn't be able to access. I would say that today, I spend the bulk of my time on issues related to IT security."

U.S. Bank's approach to security is "very aggressive at the endpoints," said Hodge. The bank locks down USB ports, doesn't allow iPods, scans transmissions for credit card or other personal information, filters out potentially dangerous URLs, and logs and tracks usage information across the organization.

"If sensitive information shows up in the public domain, we want to know who lost it," he said.

The other Gary, Notre Dame's Dobbins, doesn't have the luxury of restricting user access across the enterprise. "There is a perception in the university environment that safe access isn't free access," he said. "It's like trying to operate a network for a whole city, but without network-based controls."

Notre Dame is tasked with facilitating the use of Web 2.0 applications across its campuses, but it must also protect the personal information of students, faculty, and employees, which have been breached or exposed at many other universities. As a result the home of the Fighting Irish has created a narrow "perimeter" that protects personal information and other sensitive data while making next-generation applications and services available to users whose PCs aren't controlled by the university.

"We've had to define a group of very granular controls and a system of layered protection that's necessitated by Web 2.0," Dobbins said.

The use of blogs, social networking, and next-generation technologies is "turning security on end," said Dmitri Alperovitch, director of intelligent analysis and hosted security at Secure Computing, which hosted the keynote panel. "The idea that any user can produce content is totally contrary to the old model. The browser is now the new operating system, but it was never designed for that."

"Securing the network at the perimeter used to work," said John McNulty, chairman and CEO of Secure Computing, who moderated the panel even after announcing his retirement last week. "That's not going to work anymore."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Secure Computing Corp. (Nasdaq: SCUR)

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Edge-DRsplash-10-edge-articles
    7 Old IT Things Every New InfoSec Pro Should Know
    Joan Goodchild, Staff Editor,  4/20/2021
    News
    Cloud-Native Businesses Struggle With Security
    Robert Lemos, Contributing Writer,  5/6/2021
    Commentary
    Defending Against Web Scraping Attacks
    Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win an Amazon Gift Card! Click Here
    Latest Comment: "Network congestion ahead."
    Current Issue
    2021 Top Enterprise IT Trends
    We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
    Flash Poll
    How Enterprises are Developing Secure Applications
    How Enterprises are Developing Secure Applications
    Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2021-27342
    PUBLISHED: 2021-05-17
    An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote attacker to circumvent the anti-brute-force cool-down delay period via a timing-based side-channel attack
    CVE-2021-31727
    PUBLISHED: 2021-05-17
    Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \.\ZemanaAntiMalware, register with the driver using IOCTL 0x8000201...
    CVE-2021-31728
    PUBLISHED: 2021-05-17
    Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook wit...
    CVE-2021-32402
    PUBLISHED: 2021-05-17
    Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurations in inputs and modules.
    CVE-2021-32403
    PUBLISHED: 2021-05-17
    Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mechanisms for token protection and unsafe inputs and modules.