Network Security Consolidation is Not Only About Cost

Most medium to large European companies plan to consolidate network security on a single hardware appliance in the next year, but cost is not the only driver.

Ninety per cent of IT directors polled in the UK, France and Germany say they will consolidate their networks in the coming months.

Reducing cost is one of the main reasons for the move, but simplified network security management is the biggest driver overall.

Rick Cole, IT manager at financial services firm B&CE, says the move to a single appliance for all network security is a "no-brainer".

The switch was prompted by B&CE's need to upgrade its firewall security and capacity to support new e-commerce projects.

"I could not see the sense in getting to grips with several software products, when it could be done all in one package," says Cole.

B&CE plans to run its new firewall on a single Fortinet unified threat management (UTM) appliance and then gradually add all other network security applications.

Organizations are typically able to put e-mail filtering, web filtering, intrusion prevention, network gateway anti-virus, and access control applications on a UTM appliance.

IT staff will only have one network security management console to learn how to use, there will be improved visibility of network activity, and better reporting through consolidation.

Cole says administrative benefits include having a single point of contact for support and not having to manage several separate software licenses and service contracts.

Andy Hamilton, network manager at University College Oxford, says having only one set of skills to learn is a great time saver.

"Simplified training and quicker support from one company are definite benefits," he says.

Hamilton says improved security is another big benefit of having a single appliance from a single supplier.

"This means there are no interoperability issues. It is also easier to secure one box than multiple boxes," he says.

Improved security is one of the top three reasons survey respondents cite for network security consolidation, but it is the top reason given by UK respondents, ahead of improved management and lower operating costs.

Tony Dyhouse, director at Cyber Security Knowledge Transfer Network, says UTM means systems are combined, making security a simpler process.

"This means there is less reliance on experts because the product is simpler and more manageable. This is particularly useful for smaller companies that cannot afford the same level of security expertise as larger companies," he says.

Overall, lower costs is the second most important reason given for consolidating network security.

B&CE expects to cut operating costs by about half, and University College estimates that costs have dropped by a third.

Dyhouse says the recession has put great pressure on security managers to justify their expenditure.

"Moving to products which can offer multiple functions is a good way to show cost saving to the board," he says.

Richard Brain, technical director at security firm Procheckup, which operatives five UTMs, says advantages also include savings in power consumption and rack space.

Romain Foucherou, an analyst at IDC, says the recession has taught most organizations the value of a consolidated approach to network security, which frees businesses from rigid per-user licensing models.

"Once companies have invested in a single hardware appliance, new capabilities can be added with a simple hardware upgrade," says Foucherou.

This means organizations can be assured of future scalability as the business grows and the threat environment changes, without buying additional hardware.

However, Brain warns that consolidation carries the risk of having a single point of failure for all network security applications.

He also cautions against potential hidden costs. "Watch out for extras like support and 24-hour call out. This can be expensive," he says.

Foucherou says UTM appliances have come a long way in the past three years. Technological advances have enabled the security, reliability and throughput that enterprises demand.

This has been one of the main reasons UTM solutions have graduated from branch offices to enterprises, backed by a strong focus of suppliers on the higher end of the market.

Link

Critical Security Hole Hits Firefox 3.5

Mozilla is working on a fix for a "highly critical" vulnerability in is Firefox browser.

The vulnerability, which puts users at risk of remote code execution attacks, affects Firefox 3.5, but other versions may also be at risk.

Mozilla said an attacker can exploit the vulnerability by luring Firefox users to a malicious web page containing the exploit code.

The security hole is due to an error in the way JavaScript code is processed, according to the US Computer Emergency Readiness Team (US-CERT).

"Exploitation of this vulnerability may allow an attacker to execute arbitrary code. Additionally, exploit code is publicly available for this vulnerability," US-CERT warned.

Proof-of-concept exploit code was posted on Milw0rm.com, an exploit code aggregation site.

US-CERT said Firefox users should disable JavaScript. The organisation has also posted instructions on other ways of mitigating the risk until a fix is released.

Link

Microsoft Challenges Google With Free Web-Based Office 2010

Microsoft has intensified competition with Google by announcing a free web-based version of its Office software.

Office 2010 will include stripped-down versions of Word, Excel, PowerPoint and OneNote in a strong response to competition from Google Apps.

Investors responded positively to Microsoft's move, sending shares almost 3.8% higher to close at $23.23, according to the BBC.

The announcement comes less than a week after Google announced it was developing a free operating system, challenging Microsoft's Windows operating system.

Google's Chrome OS announcement came just weeks after Microsoft launched its Bing search engine, which is designed to challenge Google in the search arena.

Both companies are investing in online development in response to user demands for powerful web-based collaboration applications that are reliable.

Giving millions of Windows Live users free access to the Office web applications could put $4bn in revenue at risk, according to The Wall Street Journal.

But analysts say the move is a smart one to keep as many people as possible using Microsoft applications and is probably worth the risk.

The move is also unlikely to affect Microsoft's overall business as the firm makes most of its money from business users of its productivity software.

Microsoft said it will experiment with placing advertising on the online applications before making them available, according to the Financial Times.

Microsoft plans an early release of web applications to thousands of testers later this year, followed by a public beta at the end of the year and a full release in early 2010.

Link

No Such Thing as Too Much Credit

If a little is good, is more better? Unless you can't help but spend money you don't have, the answer is yes. Here are 6 reasons high credit limits are helpful.

We've known the basics of how credit scoring works for nearly a decade now. Yet I still hear from readers who think they can improve their credit, or their finances, by closing accounts or having their credit limits lowered.

This behavior stems, I believe, from the still-widespread myth that you can have too much credit.

Here's the reality: There's no such thing as too much credit, unless you're a debt addict. If that's the case -- if you've never seen a credit card you couldn't max out -- then this column is not for you. You should cut up your cards, seek counseling and pay off your debt.

Most people, by contrast, handle credit more or less responsibly. Forty percent of cardholders regularly pay their balances in full, according to Federal Reserve statistics, and half of those who do carry debt owe $3,000 or less.

It's those folks I'm talking to. And I'll say it again: There's no such thing as too much credit, particularly these days.

Here's why:

• Having "too much credit" isn't a negative for FICO scores. You might get dinged for opening the accounts, but the FICO scoring formula (the one used by most lenders) doesn't penalize you for having too many once they're opened. If you get a score and are told the reason it isn't higher is because you have "too much available credit," you probably didn't get a FICO score but one of its competitors. "We just went through the full list of reason codes for FICO scoring, and it contains nothing remotely like 'too much available credit,'" said Craig Watts, a FICO spokesman.
• Lots of available credit typically helps your credit scores. Once they're established, credit accounts typically improve your scores as long as you don't pay late or max them out. The FICO credit-scoring system is very sensitive to the gap between the credit you use and your available limits. The bigger the gap -- on each account and overall -- the better for your scores. Closing accounts or asking for lower limits shrinks that gap and can hurt your scores.
• Your income isn't a factor. I've read a lot of well-meaning but completely inaccurate advice about how you should limit your available credit to a certain percentage of your income (with the percentage varying by how much credit the particular writer has). This is nonsense. Credit-scoring formulas don't even take income into account.
• Lenders may care, but they probably won't. Before the advent of FICO scores, many lenders were suspicious of those with "too much credit," worried these borrowers would suddenly rush out, max out their cards and then default. FICO's research indicates this fear was overblown -- if you've handled credit responsibly in the past, you're likely to continue to do so -- but some lenders are still wary. If you run into one of those, you can placate them by closing accounts, but you risk damage to your credit scores.
• Credit card issuers have gone a little nuts. In their efforts to reduce their risk, many credit card companies have been slashing limits, raising rates and closing accounts. Now they're threatening to add new fees. (Read "Banks have declared war -- on you.") Some have taken more-drastic steps by targeting not just risky borrowers but good customers who have always paid on time. The people who are in the best position to fight back are those who can simply take their business elsewhere. If you have plenty of other established accounts, you can start using them instead and transfer any balances. Also, a lower limit on one card isn't a credit-scoring crisis if you have lots of other cards.
• You don't need to worry that much about fraud. Yes, identity theft is a real problem, but if one of your existing accounts is hijacked, you're not responsible for the bogus charges if you report them within 60 days. If you have so many accounts you can't keep track of them, you may want to winnow the herd, but most people can remind themselves to log in to their accounts every month or so to check their charges.

I'm often asked how many credit cards are optimal. Alas, FICO is mum about that. But FICO does say the typical U.S. adult has four to five credit cards. And some of us have a lot more.

I hesitate to use myself as an example because individual experiences can vary so much with credit scoring, but at last count I had between seven and 17 open, revolving accounts showing on my credit reports at the three major bureaus. (The bureaus are private businesses in competition with each other, and the information they report is often different.) My FICO scores typically range from the high 700s to the low 800s (the top score is 850; anything over 760 or so typically wins the best rates and terms). Clearly, my scads of available credit aren't hurting my scores.

What does ding your scores, as I've said, is opening and closing accounts and maxing out your cards. So use the following guidelines:

• Apply for credit sparingly. Applications are counted as "hard" inquiries and typically lower your scores. Although the damage of one inquiry is usually slight -- 5 points or less -- applying for a bunch of accounts in a short period could tag you as high-risk, because you'll seem suddenly desperate for credit.
• Close accounts sparingly. If you decide you must close accounts, shut down retail accounts first (those department store cards you got because of discounts), and try to keep open your major credit card accounts, particularly those with the highest limits.
• Use only a small portion of your available credit. Whether or not you pay your balances in full each month -- and you should -- you still want to use only a fraction of your available credit: 30% or less is good, 10% or less even better. The balance that's reported to credit bureaus and used in your scores is typically the balance from your last statement. If you used 50% or more of your limit, even if you paid it off in full, you could be hurting your scores.
• Push back against credit limit cuts. If you're a good customer with high credit scores, point that out to the offending issuer. If it doesn't reverse its decision, take your business elsewhere.

Published July 13, 2009

Computer Equipment Recycling: Essential Guide

Computer equipment recycling and refurbishing is an important part of an organization's sustainable waste strategy. Businesses are encouraged to dispose of their IT equipment in an environmentally responsible way, and there are government regulations, such as the WEEE directive, designed to deal with hazardous waste.

Why recycle computer equipment?

Computer equipment recycling reduces the volume of waste which ends up in landfill sites, or gets dumped illegally.

It cuts down on the amount of raw materials needed for the manufacture of new products, and it also means more efficient and convenient recycling for the end user.

In addition, if computing equipment is refurbished, this can benefit people and organizations that cannot afford to buy new IT equipment.

What computer equipment can be recycled?

It is possible to recycle many parts of an IT system, particularly monitors, PCs and servers.

Computer peripherals, such as printers and scanners, can also be recycled, as can landline and mobile phones.

However, some elements of an IT system may need particular expertise to recycle, with PCs, for example, tending to have heavy metals in their circuit boards.

What materials are in a PC?

An average PC contains plastic (23%), ferrous metals (32%), non-ferrous metals (18%), electronic boards (12%) and glass (15%).

A single computer can contain up to 2kg of lead, and the complex mixture of materials make PCs very difficult to recycle.

How do you recycle your computer equipment?

Firstly, the Department for Environment, Food and Rural Affairs (Defra) advises companies to contact their waste contractor to get advice on how they need handle their waste, as it may vary from company to company.

That said, there are a large number of disposal specialists geared up to recycle computer equipment, and these are easy to find either from local council web sites, or through a search engine.

You can also dispose of computer waste by returning the product to the manufacturer, with computer makers such as Dell and HP offering recycling and asset recovery services to organizations to recycle unwanted computer equipment securely and responsibly.

Goods are ‘de-manufactured’, and sorted according to type or material. Materials like steel and aluminum can then be recycled to make new products, from car parts to plastic toys.

Meanwhile non-reusable substances are disposed of in an environmentally sound manner.

What laws deal with computer recycling?

The two main government directives are the DTI’s waste acceptance criteria (WAC) and the European recycling Waste Electronic and Electrical Equipment (WEEE) directive.

The WEEE directive recognizes that electronic equipment needs specialist handling and disposal.

Hazardous waste covers a broad range of materials, and computer hardware recycling can deal safely with things like lead, hexavalent chromium and mercury. The aim is to keep them out of landfill sites.

The WEEE directive overlaps with the WAC, which specifically covers the handling and disposal of computer equipment such as monitors, some PCs, fluorescent tubes and televisions.

Is there an alternative to recycling equipment?

Donating obsolete, but still functional systems to charities can be a mutually beneficial option.

Also, there are many organizations throughout the UK that take computer equipment and prepare it for reuse, where possible.

Many of these are not for profit organizations and social enterprises which may provide benefit to the local community through employment of long term unemployed, or donation of equipment or profits to individuals or organizations in need.

What about sensitive data on hard drives?

The 1998 Data Protection Act makes it a legal requirement for most businesses that deal with sensitive data to keep it backed up and secure.

So, organizations are urged to have a healthy and secure data strategy, and this may include using good encryption and security technology to protect the relevant data.

It also includes disposing of it in an adequate and thorough way if the computer equipment is passed on.

But be warned that reformatting the hard drive is not sufficient to permanently destroy all data. Seek professional advice on how to dispose of data properly, to make sure those credit card and private details don’t end up on eBay.

Waste resources:

   1. Environmental Services Association
   2. Waste information resource
   3. Defra’s information on the Weee Directive
   4. Defra’s information on the Waste (WAC) Criteria
   5. Wiki on computer waste

Arif Mohamed

Apollo 11 and the Forgotten Art of Software Engineering

The Apollo lunar landing program, which culminated in Neil Armstrong and Buzz Aldrin's moon walk on 20 July 1969, represents a technical achievement that has yet to be surpassed. The computer systems that helped them get there were among the most advanced of the time. Certainly, no more complex public software project
had been undertaken before the Apollo program.

The Apollo Guidance Computer, developed at MIT for the lunar landings, was the first embedded system. It was also the first example of a fly-by-wire system. Such systems are used today on modern aircraft such as the airbus A-380. The pilots relied on computers controlled by safety-critical software to keep them alive and enable them to navigate the 384,400km to the moon, control the descent and launch of the lunar lander, and return safely back to Earth. Thousands of computer technicians and programmers were involved in the Apollo program. The software development process Nasa used to co-ordinate these people is often cited as an example of software engineering, although the term was coined midway through the lunar project.

As the world celebrates the 40th anniversary of one of man's greatest achievements this week, the idea of software projects being engineering projects has somehow been forgotten. Businesses are keen to gain a competitive edge by churning out software. Apart from in aerospace and some safety-critical -applications, speed of application development has become more important than quality. End-users accept computer bugs as a way of life. The British Computer Society is keen to raise the bar, with training, accreditation and certification, which it hopes will turn computer programming into a profession, with professional standards.

Microsoft's Trustworthy Computing initiative shows that commercial software can be made less buggy. But will users accept the price of higher quality software, the longer development time and the potentially higher license fee? They need to. As computer technology becomes embedded in human society, the effects of buggy code will become more obvious and damaging. Software must be engineered to a high quality.

Cliff Saran

IPS to Market ID Cards to Businesses

IPS marketing

The Identity and Passport Service (IPS) is to embark on a marketing campaign to persuade businesses to check staff passports and national identity cards.

It announced today that it has contracted advertising agency Proximity, part of the BBDO network, to develop below the line promotional campaigns for ID cards, passports and the General Register Office (GRO) for the next three to four years.

The contract supplements an earlier contract with Abbot Mead Vickers BBDO for above the line work to promote passport applications for first-time applicants and renewals, the Passport Validation Service (PVS), the National Identity Service, including validation services based upon data held on the national register; and genealogical services from GRO.

The Central Office of Information (COI) was unable to say how much the contracts were worth.

The latest estimated cost of the IPS for the next 10 years is £4.95bn. This includes the issue of both passports and identity cards for UK citizens. About 70% of it will go to implement secure biometric passports.

Since 2005, accredited government departments and law enforcement agencies, such as UK Border Agency, Security Industry Authority (SIA), and the DVLA, have had direct web access to the passport database.

PVS is the first business to business identity service offered by IPS, and is part of the IPS mission to be the "trusted and preferred provider of identity services", the COI said.

Link

Opinion: Chrome OS Buffs Up the Google Brand

Google's announcement that it is working on a lightweight operating system is as much about marketing as it is about technology.

After all, the technology is hardly new: at the heart of Google's Chrome OS lies the Linux kernel; on top of that is Google's existing Chrome browser, running in a new windowing system.  But to this lash-up of mostly pre-existing code, Google brings one, invaluable extra: its brand.

Google's name means that people won't need to think twice before buying first netbooks and, later, entry-level PCs, running Chrome OS; they won't need to worry about whether it will be compatible with their files or easy to use.

They will just assume that Google has sorted everything out, because they trust the brand.  Some, of course, will be disappointed with details, but the majority will be content with the simplicity of the solution.  Google will be aided in this shift because the basic environment in which everything is run is the browser – and anyone can use a browser.

But the long-term consequences of this move are much greater than this relative ease might suggest.  With its Chrome OS, Google will make the operating system not just invisible, but irrelevant: the browser becomes the platform.

Netscape tried this a decade ago and failed; Google might succeed because of two important shifts in computing that it has been driving for a while, and which Chrome OS both depends on and will help propagate even more widely.

The first is cloud computing.  Already, Google can meet almost all the needs of average users through Web apps like Gmail and Google Docs; others are doubtless under development.  Low-cost and easy-to-use Chrome OS netbooks and PCs will offer people more reasons to move their computing into the cloud - and help Google to make more money from the ads they will encounter there.

The second shift is free software, which is now sufficiently mature that Google can use it to do most of the heavy lifting, and without trying to become a full-on operating system company.

The potential loser here is clearly Microsoft, which faces an invasion of its desktop heartland by a challenger that is already well known and totally dominant online.  Its loss of market share is unlikely to be dramatic, especially at the high end, but will add to the continuing erosion of Microsoft's power and profits.

Apple, by contrast, will probably be little affected, because brand loyalty is higher – people love their Mac desktops in a way that Windows users do not.

In the world of GNU/Linux, distributions like Ubuntu that are aimed at the general user will find that they have to compete against the powerful Google brand, so life may well get harder for them.

But in one sense, whether it's an existing distro or Chrome OS that achieves a greater market share among general users is irrelevant: either way, Google's latest move is likely to provide a significant boost for open source on the desktop once Chrome OS moves from its current state of vapourware to the inevitable semi-eternal beta.

Link

Google to Challenge Microsoft With Chrome OS

Google is developing a fast, simple and secure computer operating system that is designed to work well on the web.

The operating system, called Google Chrome OS, is an open source, lightweight operating system that will initially be aimed at netbook PCs.

Google plans to open-source the operating system later this year and expects netbooks running Google Chrome OS will be available in the second half of 2010.

>> Photos: Top Ten Google Android Apps <<

Chrome OS is a natural extension of the Chrome browser, designed for people "who live on the web", said a blog posting by Sundar Pichai and Linus Upson of Google.

"It's our attempt to re-think what operating systems should be," they said.

In a thinly veiled challenge to Microsoft, Google said the operating systems that browsers currently run on were designed in an era when there was no web.

"We are designing the OS to be fast and lightweight, to start up and get you onto the web in a few seconds," said Google.

Users of Chrome OS can also look forward to a minimal user interface to make room for web-based interactions and a secure architecture.

"We are going back to the basics and completely redesigning the underlying security architecture of the OS so that users don't have to deal with viruses, malware and security updates," said Google.

Google Chrome OS is based on a Linux kernel, it will run on both Intel and ARM chips, and is aimed at enabling all web-based applications to work automatically.

Google has gradually been increasing the number of its web-based applications, such as Gmail and Google Docs, based on premise that these applications will replace traditional software.

Although initially aimed at netbook users who spend most of their time on the web, the Chrome OS is also being designed to work on full-size desktop PCs.

There are some areas where Chrome OS and Android for mobile phones and netbooks overlap, said Google, but the firm believes choice will drive innovation.

"We have a lot of work to do, and we're definitely going to need a lot of help from the open source community to accomplish this vision," said Pichai and Upson.

Warwick Ashford

Computer Programmer Arrested for Goldman Sachs Theft

Computer programmer arrested for Goldman Sachs theft

A former computer programmer at investment bank Goldman Sachs has been charged with stealing computer codes used in the bank's algorithmic trading systems.

The programmer, Sergey Aleynikov, a 39-year-old originally from Russia, was arrested on Friday.

He is accused of uploading the 32MB of code to a server in Germany.

Goldman Sachs would not comment.

Automatic trading software is increasingly important to investment firms as the number of trading venues increases and the volume of electronic trading grows.

PJ Di Giammarino, CEO at financial services think-tank JWG-IT, said: "Because of the data war out there, it is more and more down to IT systems and what messages you send them to tell them what to do and how the messages instruct them to do it."

"These codes, which have allegedly been stolen are fundamental to how Goldman makes money in electronic trading," added Di Giammarino.

The heavy reliance on computer systems to control trades at investment banks makes security a massive challenge.

In January last year French bank Societe Generale lost £3.6bn following unauthorised activity of a rogue trader who covered up fraudulent activity as a result of his understanding of the bank's fraud control systems. Paris-based Jerome Kerviel used his knowledge of automatic checks, which are carried out on trades to check they are legitimate, to avoid being found out. He risked billions by betting on future trends in the stock market.

Karl Flinders