Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

Large Businesses Wrestle With Web 2.0

New capabilities turn security policies and practices on end, panelists say

LAS VEGAS -- Interop 2008 -- If you have any doubts as to whether Web 2.0 technology is changing the nature of security in large organizations, we've got a couple of Garys for you.

Gary Hodge, executitve vice president at CTO at U.S. Bank, and Gary Dobbins, director of information security at the University of Notre Dame, appeared in a keynote panel session here this morning. Besides their first names, the two top security executives agreed on another point: Web 2.0 is seriously disruptive to security policy.

"After years of keeping them protected from the outside world, we're now exposing our internal systems to our customers; it totally changes the way we look at security," said Hodge, whose bank is the sixth-largest in the country. "Now, we have 3.5 million customers who are accessing our systems legitimately -- plus that group of bad guys who are trying to break in."

Aside from the huge problem of access control, U.S. Bank is dealing with the issues of mobile security that often accompany the move to Web 2.0. "It took us 10 years to get our employees to maintain a minimum of hygiene on their PCs," Hodge said. "Now we're not only dealing with employees, but with customers, and we're looking at iPhones and other mobile devices that may bring a whole rash of vulnerabilities."

In addition, Web 2.0 heightens the danger of insider threats, Hodge said. "We're now in a situation where we have to monitor what our employees are doing all day long. We need to know if their usage falls within normal patterns of behavior. We have to prove they don't have access to systems they shouldn't be able to access. I would say that today, I spend the bulk of my time on issues related to IT security."

U.S. Bank's approach to security is "very aggressive at the endpoints," said Hodge. The bank locks down USB ports, doesn't allow iPods, scans transmissions for credit card or other personal information, filters out potentially dangerous URLs, and logs and tracks usage information across the organization.

"If sensitive information shows up in the public domain, we want to know who lost it," he said.

The other Gary, Notre Dame's Dobbins, doesn't have the luxury of restricting user access across the enterprise. "There is a perception in the university environment that safe access isn't free access," he said. "It's like trying to operate a network for a whole city, but without network-based controls."

Notre Dame is tasked with facilitating the use of Web 2.0 applications across its campuses, but it must also protect the personal information of students, faculty, and employees, which have been breached or exposed at many other universities. As a result the home of the Fighting Irish has created a narrow "perimeter" that protects personal information and other sensitive data while making next-generation applications and services available to users whose PCs aren't controlled by the university.

"We've had to define a group of very granular controls and a system of layered protection that's necessitated by Web 2.0," Dobbins said.

The use of blogs, social networking, and next-generation technologies is "turning security on end," said Dmitri Alperovitch, director of intelligent analysis and hosted security at Secure Computing, which hosted the keynote panel. "The idea that any user can produce content is totally contrary to the old model. The browser is now the new operating system, but it was never designed for that."

"Securing the network at the perimeter used to work," said John McNulty, chairman and CEO of Secure Computing, who moderated the panel even after announcing his retirement last week. "That's not going to work anymore."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Secure Computing Corp. (Nasdaq: SCUR)

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio
     

    Recommended Reading:

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    COVID-19: Latest Security News & Commentary
    Dark Reading Staff 5/27/2020
    The Problem with Artificial Intelligence in Security
    Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
    How an Industry Consortium Can Reinvent Security Solution Testing
    Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Current Issue
    How Cybersecurity Incident Response Programs Work (and Why Some Don't)
    This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
    Flash Poll
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-10936
    PUBLISHED: 2020-05-27
    Sympa before 6.2.56 allows privilege escalation.
    CVE-2020-6774
    PUBLISHED: 2020-05-27
    Improper Access Control in the Kiosk Mode functionality of Bosch Recording Station allows a local unauthenticated attacker to escape from the Kiosk Mode and access the underlying operating system.
    CVE-2020-13633
    PUBLISHED: 2020-05-27
    Fork before 5.8.3 allows XSS via navigation_title or title.
    CVE-2020-10945
    PUBLISHED: 2020-05-27
    Centreon before 19.10.7 exposes Session IDs in server responses.
    CVE-2020-10946
    PUBLISHED: 2020-05-27
    Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.0...