Envoy Data Partners with Zvetco Biometrics

Gilbert, Ariz. December 12, 2011 – Envoy Data Corporation, a specialty distributor of IT security solutions, today announced the addition of Zvetco Biometrics to their manufacturer line. A leader in fingerprint identity and authentication solutions, Zvetco Biometrics’ line of fingerprint readers will now be available through Envoy Data’s distribution channel.

Zvetco Biometrics’ line of biometric readers provides increased accountability, enhanced security and elimination of the cost and inconvenience associated with password-based access. Ideal for use in enterprise, financial, healthcare, gaming and retail industries, Zvetco Biometrics incorporates ergonomic designs into their readers to ensure convenience as well as performance.

Distribution through Envoy Data means Zvetco Biometrics products can be combined with products from multiple IT security industry manufacturers to provide customers a complete security solution.

“Our goals are simple; utilize our exceptional relationships with industry leading manufacturers, such as Zvetco Biometrics, to offer complete solutions to our clients. We achieve this by matching competitive services and aggressive pricing, supplying cutting edge technologies, as well as providing outside sales support, full technical support staff, and impeccable customer service to all of our clients,” said Jeff Ciraulo, President of Envoy Data Corporation.

“Partnering with Envoy Data Corporation represents the next logical step in our North American sales strategy. By doing so, we quickly expand our presence across markets that demand global security solutions based on user authentication and enables us to further capitalize on growing requests for the hardened security and ease of use that biometrics bring.” states Eusebio Coterillo, Vice President Sales. “We are pleased to be a part of Envoy Data’s specialized product set for customers and partners in the rapidly expanding biometric and smart card authentication market.”

About Envoy Data
Envoy Data Corporation is an industry-leading, specialty distributor of IT security solutions, offering the most cutting-edge products in encryption, network security and USB storage. Envoy Data’s smart cards, smart card readers, tokens and CAC products fit any organization's security needs – helping businesses, government agencies and healthcare entities meet compliancy regulations and ensure peace of mind by securing sensitive information. For more information on Envoy Data, visit www.envoydata.com.

About Zvetco Biometrics

Zvetco Biometrics is a manufacturer of best-in-class identity authentication hardware and provider of identity management solutions. Founded in 1999, Zvetco provides its customers in corporate enterprise, government, financial services, healthcare, gaming, food services and point-of-sale with cost-effective network security tools that prevent identity theft, increase accountability and eliminate the cost and inconvenience of password-based access. Zvetco Biometrics' Verifi™ line of biometric products incorporates precision fingerprint-sensing technology into ergonomic computer peripherals that deliver unparalleled performance, reliability and convenience. Available in multiple form factors, Verifi™ products use proven AuthenTec and UPEK sensor technology, offer a rugged, elegant design, a standard USB interface, enhanced security and convenience, private labeling and other custom options. Information about Zvetco and its products is available at www.zvetcobiometrics.com or by calling (407) 681-0111. 

Thales Recognizes Envoy Data and Others as Top Partners for 2011

WESTON, Fla. - --(BUSINESS WIRE)--Aug. 02, 2011-- Thales, leader in cryptography and key management security solutions, recently honored its top performing channel partners at the Thales 2011 Americas Annual Partner Conference Performance Awards ceremony in Fort Lauderdale, Florida.

Thales has long recognized the value of partnerships to deliver world class security solutions that satisfy critical customer requirements. As customers increasingly demand integrated and secure business solutions Thales works closely with its partners to design, market and deliver innovative and industry leading security solutions, tools and programs that enable businesses to protect and manage their critical business assets.

At the event Thales recognized its top channel partners in the Americas for their outstanding sales and revenue achievements for 2010. The new partner program is designed to help partners grow business in their respective markets with joint solutions that leverage Thales’s portfolio of data protection, key management and payment transaction hardware security platforms.

Presenting the awards, Cindy Provin, vice president of the Americas at Thales e-Security said “The constant stream of headlines about data breaches, weakened consumer confidence, tighter privacy regulation and increasingly targeted attacks makes security high on the business agenda. Our partner program is designed to support and reward our partners who are continuously developing their security expertise, as well as driving new sales opportunities. Our channel partners are a strategic part of Thales's business and a major contribution to our overall success. I am delighted to recognize and award our top performing partners across the Americas”.

The 2010 Thales Outstanding Sales Achievement Partner Performance Award winners are:

Accuvant, Inc

Emagined Security

Envoy Data Corporation

First Tech Technologia Ltda.

Fishnet Security Corporation

Geobridge Corporation

Jack Henry

Operational Research Consultants (ORC)

SeguriData

Thales e-Security Partner Program

At the partner conference Thales announced the new Thales Partner Program aimed at building even stronger partnerships, providing new tools and programs to drive successful long-term partnerships, and rewarding partners for their investment. Each partner’s contribution is vital to our mutual success and our customers’ satisfaction. The program helps partners leverage Thales’s 40-year unrivalled security track record delivering best-in-class encryption and key management solutions for some of the most challenging customer requirements across the globe.

ENVOY DATA PARTNERS WITH CIRCADENCE® TO OFFER WAN OPTIMIZATION TO CUSTOMER BASE

Gilbert, Ariz. July 12, 2011 – Envoy Data Corporation, a specialty distributor of IT security solutions and manufacturer of industrial storage products, today announced a strategic partnership Circadence®, a leading provider of WAN optimization solutions for government and commercial customers.

“Our business model demands partnerships with state-of-the-art technology providers who meet strict regulatory requirements mandated for our customer base,” said Jeff Ciraulo, president of Envoy Data. “Circadence WAN optimization solution is proven to meet these requirements under less than optimal conditions and resources, time and time again.”  

For Envoy Data’s core markets, rapid adoption of cloud computing along with significant increase in mobile devices have strained the ability to transfer critical information across company networks. Regulatory compliance including HIPAA for healthcare and PCI for financial, retail and education (anyone taking payment) adds to the burden with stringent guidelines and audit requirements for proving secure transmission and receipt of protected data. Circadence’s MVO solution gives Envoy Data the ability to seamlessly integrate quality and speed of large data and image transfers without foregoing security.

“Our partnership with Envoy Data quickly expands our presence across markets that demand safe and secure data transfer without sacrificing speed,” said Jim Bollback, vice president of channel and alliances for Circadence. “We are pleased to be a part of Envoy Data’s specialized solution set for customers and partners in the rapidly expanding mobility security market.”

About Envoy Data

Envoy Data Corporation is an industry-leading, specialty distributor of IT security solutions, offering the most cutting-edge products in encryption, network security and USB storage. Envoy Data’s smart cards, smart card readers, tokens and CAC products fit any organization's security needs – helping businesses, government agencies and healthcare entities meet compliancy regulations and ensure peace of mind by securing sensitive information. For more information on Envoy Data, visit www.envoydata.com.

About Circadence

Circadence MVO™ WAN Optimization solutions are in use today by some of the most sensitive organizations around the world. The company’s technology ensures efficient, secure delivery of electronic content. Based on more than ten years of intellectual property and 20 patents, the company has one of the most extensive WAN Optimization portfolios including the company’s patented Transport Morphing Protocol (TMP), which is built into the Circadence MVO solution. Circadence ensures the efficient use of bandwidth while providing additional data transport speed, reliability and consistency. For more information on Circadence, visit www.circadence.com.

                                                                    ###

Circadence®, a leading provider of WAN optimization solutions for government and commercial customers, today announced partnership with Outdoor Nation, the nationwide initiative that empowers young people to champion the outdoors through events, entertainment, action and advocacy. The Circadence partnership, in its second year, provides scholarships for 12 youth leaders from Mississippi to attend the Southeast Regional Outdoor Nation Summit in Atlanta, GA. Outdoor Nation Summit kicked off last week with a National Congress in New York''s Central Park, with representatives from all 50 states.

"For Mississippians, the outdoors is a way of life," said Brad Pewitt, vice president of government relations and Mississippi operations for Circadence. "Sending delegates from Mississippi to Outdoor Nation, represents our generational commitment to the nation''s great outdoors. Circadence is proud to be a part of this national initiative."

Sponsored delegates will attend the three-day regional summit in Atlanta where these young leaders brainstorm project ideas developing their own solutions to regional outdoor issues.

"The Circadence team appreciates the fragile state of our environment and the need for young people to become more engaged in setting and following through with a national outdoor agenda," said Mike Moniz, CEO of Circadence. "Whether volunteers focus on our state park system, environmental literacy or the simple notion of getting children outside and active, this year''s goals mirror our convictions. Our partnership with Outdoor Nation gives our next generation of leaders the opportunity to fuel their passion for the outdoors while celebrating an active, outdoor lifestyle."

About Circadence

Circadence MVO™ WAN Optimization solutions are in use today by some of the most sensitive organizations around the world. The company''s technology ensures efficient, secure delivery of electronic content. Based on more than ten years of intellectual property and 20 patents, the company has one of the most extensive WAN Optimization portfolios including the company''s patented Transport Morphing Protocol (TMP), which is built into the Circadence MVO solution. Circadence ensures the efficient use of bandwidth while providing additional data transport speed, reliability and consistency. For more information on Circadence, visit www.circadence.com.

About the Outdoor Foundation

The Outdoor Foundation is a not-for-profit organization dedicated to inspiring and growing future generations of outdoor enthusiasts. Through groundbreaking research, action oriented outreach, and education programs, the Foundation works with partners to mobilize a major cultural shift that leads all Americans to the great outdoors. In 2010, the Foundation launched Outdoor Nation, a pioneering initiative that aims to empower youth to champion the outdoors on campuses and in communities across the United States. For more information visit:OutdoorFoundation.org and OutdoorNation.org.

Contacts:

Circadence
Taylor Moritz
Channel Marketing Coordinator
tmoritz@circadence.com
or
Schwartz Communications
Nina Gill, 781-684-0770
circadence@schwartzcomm.com

Envoy Data Corporation to Ease Concern over Recent Data Breaches at Baltimore Tradeshow

Envoy Data Corporation, ActivIdentity to bring IT security expertise to Baltimore Tradeshow

Envoy Data Corporation Finds Success in San Diego

Envoy Data Corporation, a Leading IT Security Service Provider, leverages San Diego tradeshow to synergize with partners, build new relationships

Envoy Data and ActivIdentity Team-up for San Diego Tradeshow

On May 5^th, Envoy Data and ActivIdentity will bring their knowledge and expertise about IT security solutions to San Diego at the annual Data Connectors Tech Security Conference. 

Read More >>

Read More >>

Envoy Data Corporation and Indigo Identityware™ Announce Distribution Partnership

Indigo Identityware, a rapidly-growing leader in providing Behavioral Enterprise Single Sign-on (ESSO) with Integrated Strong Authentication software, has recently partnered with Envoy Data to market and deploy its line of ESSO software.

“Our goals are simple; leverage our exceptional relationships with industry leading manufacturers, like Indigo Identityware, to offer complete solutions to our clients. We achieve this by matching competitive services and aggressive pricing, supplying cutting edge technologies, as well as providing outside sales support, full technical support staff, and impeccable customer service to all of our clients,” said Jeff Ciraulo, President of Envoy Data Corporation.

“We are very excited to partner with a quality organization such as Envoy Data. Our values and goals closely align in delivering the next generation of security solutions such as Indigo’s strong authentication and behavioral ESSO,” said John Woodward, COO and President of Healthcare for Indigo Identityware.

 About Indigo

Indigo Identityware is a leader in the identity and access management industry. Indigo distinguishes itself by offering the first and only behavioral enterprise single sign-on with integrated strong authentication. Indigo’s flexible design supports multiple strong authentication methods, including next generation biometrics, providing users with secure and fast access to information. Indigo knows exactly who you are, knows the way you work, and works the way you want it to. It increases workflow productivity while helping customers ensure regulatory compliance. The software-only solution is cost-effective and deploys quickly with its unique, lightweight “snap-in” design. No expensive hardware, third party licenses, or resource-intensive implementation costs are required. No other product offers the capabilities, flexibility and value that Indigo provides to organizations of any size.

Former White House Advisor, security expert, and best-selling author to join Identive Board of Directors.

SANTA ANA, Calif. and ISMANING, Germany, Dec. 22, 2011 (GLOBE NEWSWIRE) -- Identive Group, Inc. (Nasdaq:INVE) (Frankfurt:INV), a provider of products, services and solutions for the identification, security and RFID industries, today announced that Richard A. Clarke has been appointed to its Board of Directors, effective January 1, 2012.

"Richard Clarke is a true pioneer in crucial areas of cyber security and was amongst the first to call for combining cyber and physical identity management systems. Since the early days of Identive's predecessor Bluehill ID, Dick has been a supporter of our vision to create a company totally focused on Secure ID. He brings to the Board a truly rare blend of strategic vision and a deep understanding of electronic security threats, how they relate to geopolitical issues and the technologies being exploited. It is an honor for Identive to be the first public operating company for which Richard Clarke has become a director," said Ayman S. Ashour, Chairman and CEO of Identive.

"I have long been impressed with Identive's holistic approach to Secure ID, and in particular their focus on convergence of cyber and physical security as well as cloud-based identity management platforms. I am pleased to join the company's Board of Directors to help guide the next phase of growth," stated Clarke.

Richard A. Clarke is an internationally-recognized expert on security, including cyber security, homeland security, national security and counterterrorism. Currently he is Chairman of Good Harbor Consulting, a strategic security risk management firm. From 1992 to 2003, Mr. Clarke served three Presidents as a senior White House Advisor, holding the titles of Special Assistant to the President for Global Affairs, National Coordinator for Security and Counterterrorism, and Special Advisor to the President for Cyber Security. Prior to his White House years, Mr. Clarke served for 19 years in the Pentagon, the Intelligence Community, and State Department. He is currently an on-air consultant for ABC News and teaches at Harvard's Kennedy School of Government. Mr. Clarke is the author of numerous best-selling books, including Cyber War: The Next Threat to National Security and What to Do About It. He holds a BA from the University of Pennsylvania and a Masters degree from the Massachusetts Institute of Technology.

About Identive Group

Identive Group, Inc. (Nasdaq:INVE) (Frankfurt:INV) is focused on building the world's signature company in Secure ID. The company's products, software, systems and services address the markets for identity management, physical and logical access control, NFC and a host of RFID-enabled applications for customers in the government, enterprise, consumer, education, healthcare and transportation sectors. Identive's mission is to build a lasting business of scale and technology based on a combination of strong technology-driven organic growth and disciplined acquisitive expansion. For additional info visit: www.identive-group.com.

Original appearance:  http://www.globenewswire.com/newsroom/news.html?d=241403

 Smart Card Alliance Wraps Up 2011 with Release of the First 'E-Yearbook'

Comprehensive review of important events in 2011, including EMV, mobile payment, identity management and access security

Princeton Junction, N.J., December 16, 2011–From the acceleration of EMV and mobile payments to the advancement of open transit payments and cyber security initiatives like the National Strategy for Trusted Identities in Cyberspace (NSTIC), 2011 has been a landmark year for the North American smart card industry. To commemorate the year, the Smart Card Alliance has issued today its first-ever “E-Yearbook.”

The E-Yearbook, available to members and non-members on the Smart Card Alliance website, captures the essence of a year’s worth of smart card industry leadership and advancement. It includes nearly 70 colorfully designed pages containing thoughts, perspectives, insights and company profiles from smart card industry leaders across a broad spectrum of markets and technologies–including Smart Card Alliance board chairs, industry council chairs, and Executive Director Randy Vanderhoof.

“Creating this E-Yearbook allowed us to look back on fantastic year for advancements across many markets in the smart card industry and an especially productive year for our members who contribute their resources and expertise to the Smart Card Alliance,” commented Vanderhoof. “It will be especially valuable for non-members and those members who are not very engaged in the organization to get introduced to programs offered by the Alliance and its many new members and their services and products, as well as to get the background on all of happenings in the industry.”

Some of the meaningful 2011 achievements highlighted through the E-Yearbook include:

• How the North American financial industry is accelerating of EMV payments based on contact and contactless technology, and how this move can enable the market to leapfrog other global markets’ advancement of NFC mobile payments
• How six major U.S. transit centers are implementing or planning to implement open bank card fare payment, repositioning transit operators as merchants and extending acceptance of bank cards for fare payment for tens of millions of daily transit riders
• How two major competing mobile payments schemes, Google Wallet and Isis, are helping define the next generation of consumer payments using mobile devices
• How the government is driving advances in finding secure solutions for trusted eCommerce over the Internet under NSTIC and how new government mandates are driving usage of the government identity management and access security industries’ PIV (Personal Identity Verification) and PIV-I (Personal Identity Verification–Interoperable) identity credentials
• How smart card use in healthcare is being driven by promising developments in the usage of smart cards for secure electronic health record storage and access and by proposed legislation to advance trials for smart Medicare and Medicaid cards to eliminate fraud

Some of the achievements by the Smart Card Alliance recapped in the 2011 E-Yearbook include excerpts from white papers and past member profiles, an overview of Smart Card Alliance events and council activities, a summary of web site enhancements and visitor statistics, and a complete member directory including the addresses and company websites of each organization. To view the 2011 Smart Card Alliance E-Yearbook online or download a PDF version of the publication, visit http://www.smartcardalliance.org/pages/publications-2011-e-yearbook.

About the Smart Card Alliance

The Smart Card Alliance is a not-for-profit, multi-industry association working to stimulate the understanding, adoption, use and widespread application of smart card technology.

Through specific projects such as education programs, market research, advocacy, industry relations and open forums, the Alliance keeps its members connected to industry leaders and innovative thought. The Alliance is the single industry voice for smart cards, leading industry discussion on the impact and value of smart cards in the U.S. and Latin America. For more information please visithttp://www.smartcardalliance.org.

Clango Group Endorses Indigo Identityware’s iDNA™ Security Architecture for Healthcare iPads®

Indigo iDNA provides password-free two-factor strong authentication for fast, secure access to a user’s network and desktop.

Identive Unveils New Product Branding

PARIS, Nov 15, 2011 (GlobeNewswire via COMTEX) -- Identive Group, Inc. INVE -5.21% (frankfurt:INV), a provider of products and services for the identification, security and RFID industries, today at the 2011 CARTES & IDentification exhibition unveiled new product branding designed to leverage the growing breadth and depth of the Company's technology and solutions across the value chain of the Secure ID market.

       
          --  Rebranding of Identive's product brands under a single group-wide brand.
              SCM Microsystems and Arygon Technologies have for nearly 18 months
              operated under a unified organization within Identive's ID
              Infrastructure division and now will offer their market-leading RFID,
              contactless and contact-based smart card reader technology and solutions
              under the Identive brand.

          --  Smartag, TagStar and ACiG Technology, which have operated for nearly one
              year as the Transponder division of Identive, will be now offering their
              RFID solutions under the Identive brand.

          --  Hirsch Electronics will adopt the brand Hirsch Identive and will
              continue to offer security and identity management solutions to
              enterprise, institutional and government clients worldwide.

          --  Identive's cloud-based Identity as a Service (SaaS) offering will
              continue under the idOnDemand brand and integrated ID solutions for
              single card solutions, payment applications and identification systems
              will continue under the Multicard brand.

          --  Identive is adopting a new corporate logo, emphasizing the Company's
              focus on providing products, services and solutions along the entire
              Secure ID value chain.
        

KSI Rolls Out the Most Advanced Keyboard for Desktop Security

THALES PAYSHIELD 9000 ACHIEVES PCI HSM COMPLIANCE

WAN Optimization Improves Throughput for Medical Images

In this case study, the IT director of a medical imaging firm with more than a dozen clients in rural Mississippi and Tennessee explains how wide area network (WAN) optimization helped improve image transmission without the need for additional bandwidth or data circuits. The project has been so successful, the IT director said, that physicians equate the WAN optimization vendor "with a way to make transmission better and faster."

Time is of the essence when it comes to emergency medical diagnostics, especially when radiology interpretation is outsourced to a third-party. Every minute it takes for a medical image to cross the network is another minute before the image is analyzed, a diagnosis is made and treatment is administered. But ensuring timely delivery of high-resolution medical images is difficult when files are transmitted over a broad geographic area lacking modern broadband technology.

This scenario was challenging Imaging Associates of Northern Mississippi’s ability to meet its turnaround promise for its customers.

Imaging Associates provides radiology interpretation services to 11 health care facilities across northeast Mississippi and one in central Tennessee. The facilities transmit their X-ray, MRI, CAT scan and ultrasound images to Imaging Associates via WAN, DSL, cable T-1 and a variety of other public and private Internet and network connections."We have a commitment to supply a radiology report for an ER study within an hour. Sometimes that's very difficult depending on the number of images being transmitted," said Cavett Otis, IT director of Imaging Associates. "The less time that it takes to transmit the study, the more time the doctor has to make an accurate interpretation and fall within the guidelines of getting the report back as quickly as possible."

The company faces a constant struggle to get images to reading locations without spending money on additional data circuits and bandwidth, Otis said. "The bandwidth issue in rural America is the biggest issue we faced."

Otis turned to WAN optimization. Unfortunately, the first tests he conducted, using caching technology, were unsuccessful. "Each image is a new set of data, so caching doesn't have any effect on that. We're not repeating data that’s already in the cache," Otis said. We did a couple small tests with cache, and it had no impact whatsoever."

WAN optimization vendors also use compression and protocol optimization to increase network throughput. Since medical images cannot be modified, only protocol optimization was a viable option for Imaging Associates. Otis found a WAN optimization product that effectively uses protocol optimization when he agreed to a free 60-day trial with Circadence Corp.

Circadence installed its MVO 1200 Wan Optimization software in three offices, including Tippah County Hospital, Imaging Associates' most bandwidth-restricted location.

"Within seven days the results were dramatic," Otis said. "It was almost unbelievable. We went from sending an X-ray image that's roughly 10 megabits of data in two minutes, 10 seconds to as quick as 17 or 18 seconds." More generally, Otis said Imaging Associates has experienced a 50% reduction in transmission time for each image.

Circadence MVO 1200 WAN Optimization is designed to optimize any kind of traffic, including incompressible objects like medical images. MVO works by gathering information about what’s happening on the network. When it intercepts traffic that must be optimized, it uses this information to increase the throughput and speed delivery.

"In order to achieve higher throughput, it comes down to understanding the network environment in real time and being able to transfer content in a more efficient way than traditional networking," said Rob Shaughnessy, Circadence CTO.

Circadence MVO 1200 works inside the VPN tunnel that Imaging Associates uses to connect to all client sites. This VPN security makes HIPAA compliance a non-issue, Otis said. Moreover, "If the endpoint device receiving the data supported encryption, then that would be supported as well as an alternative to VPN, but we’re not using that capability at this time.”

Circadence offers MVO as an appliance or software. Altogether, Imaging Associates has five hardware-only installations and 15 software licenses. Otis said a Circadence box is deployed at a couple hospital sites between the Web server and Internet. The software client is deployed on standalone PCs in remote offices and even doctors' homes.

"The software-only client is very easy to install and configure, and can be rolled out to a machine in a very short amount of time," said Otis, adding that Imaging Associates recently began deploying MVO on doctor's mobile devices.

Because the product has proven cost-effective, adding the software client to another location is no big deal. Otis said the annual support contracts for MVO equipment costs less than what it would cost to add two more T1 lines.

"In some places we can't add more bandwidth. In some places we could have. But by using MVO we're able to avoid adding data circuits and incurring those additional monthly charges," Otis said. "We haven't added any bandwidth to four different locations in the last three years. We just use more of the software as we add different locations to read from."

With the improvement in transmission speeds, Imaging Associates no longer worries about meeting its contractual obligations with its clients. In fact, the time savings has enabled the company to increase its client base. "The only way we are able to do that is because we have more time. Time is money, and in radiology, that's very true," Otis said.

Original Appearance: http://searchhealthit.techtarget.com/news/2240110699/WAN-optimization-improves-throughput-for-medical-images

ActivIdentity Launches New Fraud Detection and Cloud Security Capabilities

4TRESS Authentication Appliance Enables Enterprise and Banking Customers to Deploy a New Level of Multi-Layered Strong Authentication More Quickly and Affordably

Fremont, Calif., Oct. 18, 2011–ActivIdentity Corporation, a global leader in secure identity solutions, part of HID Global, today introduced 4TRESS Authentication Appliance that offers a complete multi-layered strong authentication, fraud detection and cloud security capabilities to enterprises, banks and ecommerce sites. The new 4TRESS Authentication Appliance FT2011 model provides more than 15 versatile strong authentication methods that can be used in conjunction with transparent new adaptive authentication and fraud detection techniques to achieve more security, more conveniently for end-users, and more affordably.

With Advanced Persistent Threats (APTs) and bank fraud increasing at alarming rates, enterprises and online banks are looking for more effective authentication solutions that inhibit damage from credential and identity theft, without degrading user experience. ActivIdentity’s 4TRESS Authentication Appliance supports a wide range of tokens, including Web, mobile and PC soft tokens for a broad range of use cases, and also provides Out-of-Band (SMS or email) OTP for transaction level authentication to block man-in-the-middle attacks. 4TRESS Fraud Detection goes even further, profiling PCs at registration and each subsequent login attempt to transparently rate risk and intelligently allow or disallow access accordingly. 4TRESS Fraud Detection leverages a network that profiles millions of PCs daily, and utilizes network knowledge to identify bad-risk PCs the first time they attempt to access a new customer’s site. In addition, the 4TRESS Fraud Detection preserves privacy by not storing any personally identifiable information.

“Fraud detection and versatile authentication are a strong combination that fills a profound security need,” said Gartner vice president and analyst Avivah Litan. “Multi-layered fraud prevention and strong authentication that is convenient for end-users will be increasingly necessary to meet evolving business needs, security threats and regulatory standards.”

ActivIdentity has also made efforts to increase the security of cloud applications. Many organizations are delaying cloud-based applications deployment because they are uncertain how to protect data outside their firewall. 4TRESS can provide OTP, OOB, and smart card strong authentication in front of SAML V2-enabled cloud applications. This allows an enterprise to use their preferred strong authentication method wherever their data resides.

To facilitate rapid integration for online banking customers, 4TRESS supports a wide range of industry standards, with flexible API’s and offers a pre-configured template for solution partners, including deployment with the TEMENOS banking platform. The new appliance is fully localizable, Section 508-compliant and enables centralized security management.

“Our internet banking customers require high levels of additional security layers to prevent online fraud,” said Mark Gunning, business solutions director, at TEMENOS. “The ActivIdentity 4TRESS Authentication Appliance delivers a highly versatile authentication platform with excellent fraud detection capabilities to our banking system, making the TEMENOS Core Banking System the most secure and technically advanced banking system available.”

With the new 4TRESS Authentication Appliance, enterprises and banking institutions will be able to increase productivity by securely connecting from any location through a variety of devices and authentication methods. They can reduce cost by using a single versatile platform to meet the needs of diverse groups of users, while increasing user satisfaction with more transparent and efficient strong authentication.

To ensure successful deployment and operation, 4TRESS Authentication Appliance FT2011 has a host of new ease-of-administration capabilities:

• A complete turn-key, wizard-based appliance works out of the box, and requires no database, OS or Web Server expertise.
• Extended support for RADIUS and LDAP provides easy integration into eco system.
• An embedded Oracle database with high availability eliminates the need for a data base administrator.
• The Virtual Appliance option reduces cost and speeds deployment, especially for smaller enterprises.

“Multi-layered strong authentication is one of the few reliable methods of inhibiting credential theft and account escalation endemic to Advanced Persistent Threats,” said Christy Serrato, solutions marketing - financial services, ActivIdentity, part of HID Global. “4TRESS Authentication Appliance along with the ActivIdentity extended solutions portfolio ensures our customers are able to secure their networks in the most convenient, versatile and affordable manner currently available.”

CREDANT Receives Five-Star, "Recommened Product" Rating from SC Magazine

CREDANT Technologies, the trusted experts in data protection, announced that its CREDANT Mobile Guardian product received a Five-Star rating from SC Magazine in an October review of nine encryption products from various technology companies. CREDANT earned the "SC Magazine Recommended" designation, assigned to only one solution in the Group Test. This review is currently available on the SC Magazine website.

"CREDANT provides a centrally managed product delivering data-centric, policy-based protection across all data endpoints, including desktops, laptops, handhelds, smartphones, USB flash drives and other removable media," wrote Michael Lipinski, product reviewer at SC Magazine, "We were quite impressed with the full range of protection offered, including encryption enforcement for fixed, removable and mobile devices, as well as port control."

"We are proud that our product performed well in a rigorous battery of tests," said Bob Heard, CEO of CREDANT Technologies. "Our Five-Star rating from SC Magazine further validates the strength of CREDANT's centrally managed data protection platform, and illustrates why more than one thousand companies use our technology."

"Reporting was very good and provides compliance-level audit trails. Documentation is also very good. Detailed installation docs are provided, and administrative documentation is integrated with the product. This is a complete encryption offering," added Lipinski.

Thales Datacryptor Products Added to Defense Information Systems Agency (DISA) Approved Products List

The first standalone encryption devices to achieve listing on DoD-wide Unified Capabilities Approved Product List (UC APL)

WESTON, Florida, Oct 03, 2011 -- Thales, leader in information systems and communications security, announces that products from its family of Datacryptor network encryptors have been approved for inclusion on the US Department of Defense (DoD) Unified Capabilities Approved Products List (UC APL) by the Defense Information Systems Agency (DISA). DoD agencies and military services can now confidently deploy a solution that is approved by the DoD to protect sensitive and mission critical data against cyber attacks. Datacryptor is the first standalone AES 256-bit encryption device approved for use across Department of Defense network infrastructures on the DISA UC APL.

The Datacryptor product line offers a range of high-speed standalone security platforms that provide full duplex bulk and tunnel encryption at Ethernet speeds of up to 10G and SONET speeds up to OC-192. The encryptors deliver high speed point-to-point and multipoint-to-multipoint security for data in motion over wide area network (WAN) backbone infrastructures, internal networks and carrier-based MPLS networks, protecting the confidentiality of sensitive and high value data, voice and video. Unlike multipurpose devices like firewalls and switches that incorporate encryption as an add-on feature, Datacryptor is a standalone, single function device with significant performance advantages over embedded alternatives.

"We are proud to have the first standalone encryption solutions listed on the DISA UC APL. This milestone validates not only our commitment to the Federal marketplace but also our extensive experience deploying military-grade network encryption," says Cindy Provin, President of the Americas at Thales e-Security. "It is vital our customers, both Federal and commercial, have a high level of confidence in the products they buy and with Datacryptor they can rest assured that they are selecting a world class solution tested to the highest standards."

Thales has long championed best practices and industry standards with a commitment to achieving internationally recognized standards and compliance requirements. Thales Datacryptor high-speed encryptors are certified to Common Criteria EAL3 and Federal Information Processing Standard (FIPS) 140-2 level 3. FIPS is a standard defined by the U.S. National Institute of Standards and Technology and widely adopted as a security benchmark for cryptographic solutions in government and commercial enterprises. Thales's participation in both the Common Criteria and FIPS programs gives customers the assurance that products have been developed in accordance with internationally recognized best practice. The addition to DISA UC APL is further independent validation that our products meet the highest security standards.

Thales's complete line of Datacryptor Layer 2 network encryptors appear on the DISA UC APL, including SONET OC3/12/48/192 and Ethernet 1Gbps and 10Gbps solutions, Products approved for use on DoD networks are available at: https://aplits.disa.mil/processAPList.do/ . When searching by "Device Type," Thales Datacryptor is listed under Virtual Private Network Concentrators.

original appearance

SC Magazine Awards Axway MailGate(R) "Outstanding" Five-Star Rating

 PHOENIX, Sep 26, 2011 -- Axway, the Business Interaction Networks company, announced today SC Magazine awarded its Axway MailGate(R) email security solution a five-star overall rating in a recent round-up of email content management solutions, citing excellent built-in compliance and data leakage prevention capabilities.

SC Magazine, a leading publication for IT security professionals, compiled a group of email security products and rigorously evaluated them based on performance, ease of use, features, documentation, support and value for money. Axway MailGate was awarded the "outstanding" five-star overall rating, and "an 'A' on the product's report card," specifically for ease of installation and deployment, simple policy configuration and overall value.

"The MailGate from Axway provides full email content management, as well as digital rights management and a little bit of policy compliance, all wrapped up into one appliance," said Peter Stephenson of SC Labs, SC Magazine's testing facility for product reviews. "The Axway MailGate offers some solid functionality to protect the enterprise from email threats, as well as added functionality to manage data leakage."

Axway MailGate, a comprehensive, high-performance email security solution, provides multiple tiers of security that block threats such as viruses and other malware both within the network and at the DMZ, and prevents unwanted email and spam from entering the network. Inbound and outbound email is secured at the content and network levels; and accidental and intentional email data leakage that so often threaten brand, reputation, regulatory compliance and intellectual property are prevented via content filtering and intuitive policy controls.

Axway recently announced the launch of MailGate 5.0, which includes enterprise-class features such as gateway-to-gateway policy-based encryption, regulatory compliance lexicons, enhanced digital rights management, archiving capabilities and support for Internet Protocol Version 6 (IPv6). Additionally, MailGate now allows companies to leverage disaster recovery and high availability capabilities to survive a data or server catastrophe with email intact. Customers can also choose to deploy secure messaging via a powerful user-to-user email encryption platform on the same Linux or VMware box with MailGate, for an all-inclusive email security solution.

"The 'outstanding' rating from SC Labs re-affirms our emphasis on quality and usability in our MailGate solution," said Joe Fisher, executive vice president of product strategy and solutions, Axway. "MailGate's ability to protect organizations from attacks and data loss, and its capabilities around policy and compliance, help to differentiate our customers from their competition. We will continue to evolve the product to meet and exceed the data security needs of enterprises and their customers."

Read SC Magazine's product review of MailGate here.

HID Global Wins ASIS 2011 Accolades Security's Best Award

HID Global, trusted leader in solutions for the delivery of secure identity, today announced that its new iCLASS SE family of products has been selected by the ASIS International organization as a winner of the 2011 ASIS Accolades -- Security's Best competition. Judges representing a cross-sector of end-users and technology experts evaluated more than 70 entries before selecting HID Global's next generation iCLASS SE platform as one of the most innovative new solutions for 2011.

"HID Global is very proud to have our groundbreaking iCLASS SE access control platform recognized by one of the most respected organizations in the security industry," said Tony Ball, senior vice president of Identity Access Management with HID Global. "This ASIS Accolades award is further validation of our industry leadership and innovation, which continues to drive the industry and redefine the delivery of secure identity."

HID Global's iCLASS SE platform marks an important milestone in how secure identity is delivered and managed by introducing technology-independent digital credentials that can be deployed for use on smart phones, microprocessor-based cards, contactless smart cards, USB tokens and related devices. The platform includes credentials and readers based on a combination of Secure Identity Object (SIO) technology on the credential side and the SIO Processor(TM) on the reader side that perform similar functions to traditional cards and readers, except they use a standards-based and flexible identity data model that provide a new level of security, portability and performance.

PCI Council beefs up wireless guidance

The PCI Security Standards Council, charged with managing payment security guidelines, on Friday issued updated guidance around protecting wireless technology in cardholder environments. The update offers expanded advice on securing Bluetooth, and provides methods for testing and detecting rogue wireless access points, which are unauthorized Wi-Fi entryways typically set up by attackers to sniff network traffic. The council first released procedures to secure wireless in 2009.

To read the full update, click here.

HID Global Launches Certified Online PIV-I Credential Service for Federal Contractors

Convenient Web Portal from the Leader in Physical Access Control and Identity Credentials Makes it Easier to Obtain Government-Mandated PIV-I Cards

IRVINE, Calif., Aug 29, 2011 (BUSINESS WIRE) -- HID Global, trusted leader in solutions for the delivery of secure identity, today announced a comprehensive online service at www.hidglobal.com/piviservice that significantly reduces the time and complexity required for contractors to obtain employee credentials which comply with the government's Personal Identity Verification -- Interoperable (PIV-I) requirements.

"For organizations that must use PIV-I credentials, the new, certified HID Global PIV-I Service provides a single and simple, on-demand solution from the global leader in physical access cards and a leader in PIV card issuance technology," said Tony Ball, senior vice president of Identity and Access Management for HID Global. "Users can save time with our four-step enrollment process and convenient, online ordering and payment portal, while enjoying the convenience of 24-hour, web-based account access for managing all of their PIV-I credentialing requirements."

About Federal Identity Requirements

Homeland Security Presidential Directive-12 (HSPD-12) mandates the use of secure and reliable forms of identification by all federal employees and contractors. According to OMB 11-11; a February 2011 memorandum from the U.S. Department of Homeland Security (DHS) and Office of Management and Budget (OMB), starting next fiscal year, federal agencies may not use development and technology refresh funds until they upgrade existing physical and logical access control systems to use PIV credentials in accordance with National Institute of Standards and Technology (NIST) guidelines.

About PIV-I Certification

HID Global has completed all of the policy compliance and interoperability testing that is required to cross-certify its PIV-I Service through CertiPath(R), the government partner responsible for testing PIV-I credentials used for physical and logical access in collaboration with the Federal Public Key Infrastructure (FPKI) Policy Authority. CertiPath's approval provides validation that the PIV-I Service meets rigorous standards and is cross-certified to the U.S. Federal Bridge according to PIV-I standards.

About HID Global's PIV-I Service

The certified HID Global PIV-I Service offering will be managed through ActivIdentity(TM), recently acquired by HID Global. ActivIdentity has been a leading provider of PIV issuance and verification software to the U.S. federal government for more than 10 years, in accordance with U.S. government requirements for physical access to secured buildings and logical access to government resources. As a Genuine HID solution, the HID Global PIV-I Service is backed by the highest levels of global product quality and delivery performance.

"Our certificate-based credential issuance and verification technology is already widely used by U.S. federal agencies, and both national and local government agencies around the world, including The National Policing Improvement Agency (NPIA) in the U.K.," said Jerome Becquart, ActivIdentity general manager. "Now, we are applying this expertise to an easy and convenient service that federal contractors can use to obtain PIV-I cards for employees who require access to U.S. government facilities, networks and information systems."

The HID Global PIV-I Service is an element of the company's recently unveiled Federal Identity Initiative, which provides customers with turnkey solutions for complying with HSPD-12 requirements that are embodied in Federal Information Processing Standards Publication 201 (FIPS-201) without having to replace their current physical access infrastructures.

How to Register Your Company

To get started, register your company by completing the Customer Application or call 1-855-HID-PIVI (1-855-443-7484). This creates an online account for one or more of your company representatives to purchase PIV-I cards and sponsor employees. Once employees have been sponsored, they will receive an email directing them to our enrollment website. The enrollment website takes employees through four simple steps to obtain their PIV-I cards.

 Axway Adds High Availability and Disaster Recovery to Award-Winning MailGate® Solution

PHOENIX--(BUSINESS WIRE)--Axway (Paris: AXW), the Business Interaction Networks company, announced today the release ofMailGate® 5.0, which combines email network protection, policy-based content filtering, automated encryption and more in a single, integrated solution. Award-winning Axway MailGate now allows companies to leverage disaster recovery and high availability capabilities to survive a data or server catastrophe with email intact. The product is designed to protect the entire email network and reduce infrastructure costs and the liabilities associated with unsecured and unmanaged email communications.

“Unsecure email can expose companies to serious vulnerabilities, including detrimental malware and leaks of company data. Companies must invest in comprehensive data security solutions, not just for their business, but to protect their employees, partners and customers.”

 

Now including secure messaging functionality on a hardened Linux appliance, the latest release of Axway MailGate includes enterprise-class features such as gateway-to-gateway encryption, regulatory compliance lexicons, enhanced digital rights management, archiving capabilities and support for Internet Protocol Version 6 (IPv6). Using one appliance for all email security means easier management, fewer servers, less of a learning curve for IT departments and lower total cost of ownership (TCO) for organizations.

“Now more than ever, business networks are under increased scrutiny to secure their business interactions. Email often plays a starring role in how we manage sensitive files and share proprietary data,” said Eric Ouellet, research vice president at Gartner. “Unsecure email can expose companies to serious vulnerabilities, including detrimental malware and leaks of company data. Companies must invest in comprehensive data security solutions, not just for their business, but to protect their employees, partners and customers.”

“A corporate email security strategy is only as strong as its weakest link. With the near daily headlines around both accidental data loss and natural disasters, IT departments now are responsible to manage more sophisticated email protection and recovery strategies,” said Joe Fisher, executive vice president of product strategy and solutions, Axway. “Axway’s comprehensive email security solutions couple industry-leading inbound protection with award-winning outbound policies and data recovery to reduce the liabilities associated with unprotected and unmanaged email communications, administrative headaches and infrastructure costs.”

Axway MailGate Key Features and Benefits:

• Inbound threat protection: Reduces network congestion and enhances employee productivity with virus protection, anti-spam filtering and defense against dark traffic.
• Outbound and inbound message security and data loss prevention (DLP): Universally enforces policies that protect confidential information and intellectual property, and ensures compliance with government regulations and corporate policies. Axway MailGate is the only product of its kind that can decrypt and inspect S/MIME encrypted email against an organization’s set policies. MailGate also validates digital signatures and enforces policy on digitally signed messages.
• Enterprise-grade capabilities: MailGate supports comprehensive email security infrastructures for large enterprises, and multi-tenancy support allows different policies to be applied to different business units and departments with a single installation – reducing deployment and maintenance costs.
• Disaster recovery and high availability: Leverages network-attached storage (NAS) to enable true application-based high availability, for seamless functionality in the event of system failure. Disaster recovery capabilities allow backed-up data to be restored.
• Integrates with industry-leading email data encryption solution: MailGate now incorporates Axway Secure Messenger, a powerful policy-based email encryption platform.
• IPv6 Support extended to secure messaging: Governments and businesses worldwide are creating initiatives for adopting IPv6 seamlessly into their existing IT infrastructure.

OpenTrust to be Acquired by Keynectis

Keynectis, European leader in trust-based solutions and services, today announced that it has entered into exclusive discussion to acquire OpenTrust, the recognized market leader in trusted infrastructure solutions for enterprise and government.

The complementarity of products and services of the two companies will enable Keynectis to accelerate its growth, both domestic and international where the OpenTrust brand is already highly recognized. This acquisition will increase Keynectis’ export sales to over 30% of total revenues.

“The acquisition of OpenTrust by Keynectis will enrich the product offering for our customers and will considerably boost the delivery of OpenTrust products in SaaS mode. This merger is a unique opportunity to build the European leader of Trusted Infrastructures able to conquer international markets rapidly”, said Olivier Guilbert, CEO of OpenTrust.

“This acquisition project has all ingredients necessary for success“, said Pascal Colin, CEO of Keynectis. “Both companies, located in Issy-les-Moulineaux, the French Silicon Valley, have a strong common background. Combining the products of the two companies will result in a portfolio that will meet broader market needs. Moreover, this operation is backed by Keynectis shareholders that are key players in the Trust & Security marketplace“.

The two companies are assisted in their negotiations by Oddo Corporate Finance and ReedSmith, respectively investment bank and legal advisor for Keynectis, and Cannacord and Chamas & Marcheteau, investment bank and legal advisor for OpenTrust.

OpenTrust is primarily funded by leading investment funds: Iris Capital, GemVentures, Crédit Agricole Private Equity, Elaia Ventures, Seeft Ventures and 123Venture.

Keynectis shareholders are Gemalto, Morpho (Safran Group), CDC (Caisse des Dépôts et Consignations), Euro-Information (Crédit Mutuel-CIC Group), TDH (Thierry Dassault Holding) and Imprimerie Nationale (National Printing Group). M. Thierry Dassault is Chairman of the Board.

The transaction is due to close this summer with Keynectis acquiring 100% of OpenTrust.

Gemalto announced Qatar’s Supreme Council of Information and Communication Technology has selected it to deploy the Coesys eGov 2.0 solution for eGovernment in Qatar.

Using Qatari citizens’ national eID card as a strong authentication token, the solution will boost usage and enhance access security of their national eGovernment services portal – the Hukoomi. Qatar plans to expand the existing service to integrate more than 50 eGovernment initiatives over the next years.


Original Appearance:  http://www.secureidnews.com/2011/07/05/qatar-taps-gemalto 

Ponemon Institute Survey Finds 90 Percent of Businesses Fell Victim to Cyber Security Breach at Least Once in the Past 12 Months

Juniper Networks Sponsored Survey Finds Security Breaches Cost 41 Percent of Businesses at Least a Half a Million Dollars to Address

        
        --  Only 11 percent of respondents know the source of all network security
            breaches.
        --  Almost half, 48 percent cite complexity as one of their biggest
            challenges to implementing network security solutions -- with the same
            percentage of respondents saying it is due to resource constraints.
        --  Combating cyber attacks can be made more effective by streamlining or
            simplifying network security operations, said 76 percent of
            respondents.
        --  Seventy-five percent say their effectiveness would increase by
            implementing end-to-end solutions.
        --  Twenty-eight percent are earmarking more than 10 percent of their
            budgets to security to address these issues.
        --  Employee mobile devices and laptops are seen as the most likely
            endpoint from which serious cyber attacks are unleashed against a
            company.
        --  The top two endpoints from which these breaches occurred are
            employees' laptop computers with 34 percent and employees' mobile
            devices with 29 percent.
        
        

        
        Media Relations:
        Danielle Hamel
        Juniper Networks
        (408) 936-7817
        dhamel@juniper.net
        
        Investor Relations:
        Kathleen Nemeth
        Juniper Networks
        (408) 936-5397
        knemeth@juniper.net
        
        
        

        mailto:dhamel@juniper.net
        mailto:knemeth@juniper.net
        

Original Appearance:  http://www.marketwatch.com/story/ponemon-institute-survey-finds-90-percent-of-businesses-fell-victim-to-cyber-security-breach-at-least-once-in-the-past-12-months-2011-06-22?reflink=MW_news_stmp 

 OpenTrust Releases Next-Generation PKI

PARIS--(BUSINESS WIRE)--OpenTrust, the Next-Gen IT security software publisher today announced the immediate availability of a new version of OpenTrust PKI, its flagship product for building the foundations of a trusted IT infrastructure.

OpenTrust PKI is used by many of the world’s most influential organizations to create, issue and manage the digital identities of all users and devices. OpenTrust PKI provides solid and secure foundations on which other applications and components such as access control, digital signatures and secure file transfer are built.

OpenTrust PKI oversees the complete credential management for Public Key certificates in IT infrastructures and is compatible with corporate badge solutions and mobile devices. OpenTrust PKI’s modular architecture allows support for singular or multiple applications, management of certificates and keys locally or centrally, and can be implemented within a centralized or decentralized architecture. OpenTrust PKI is Common Criteria Certified reflecting OpenTrust’s ongoing commitment to comply with the most stringent security standards.

The new OpenTrust PKI now supports ECDSA and GOST Elliptic Curve Cryptography as an alternative to RSA. Other improvements include SNMP monitoring with dashboard for integrated PKI monitoring as well as support for a wide range of internet browsers including Internet Explorer 9 and Google Chrome. The new OpenTrust PKI is already being used by OpenTrust partners worldwide who have successfully tested and validated OpenTrust PKI with their products.

Gemalto Wins 2011 A.T. Kearney Best Innovator Award

Amsterdam, June 16, 2011–Gemalto (Euronext NL0000400653 GTO), the world leader in digital security, today announces it has been distinguished with the A.T. Kearney 2011 Best Innovator Award, in recognition for its best-in-class innovation management and leadership. The evaluation focuses on the practical “how to” in innovation practice and assesses what leading companies really do in order to achieve superior yield from their innovation strategies and investments. The jury, which is comprised of senior business executives, ranked Gemalto clearly first amongst a number of nominated global industry leaders.

The selection criteria focus on the processes in place to encourage and manage innovation. And it evaluates actual achievements at delivering innovative products and services. Gemalto demonstrated a clear vision in making the digital world more convenient and secure for businesses and consumers alike. In particular, Gemalto remarkably evidenced a repeatable and well established system of innovation management that practically resulted in a succession of successful breakthroughs towards high-growth markets such as e-Government services, machine-to-machine applications and mobile financial services.

In addition to the creativity of its 1400 research scientists, Gemalto notably developed an internal think-tank and reward system allowing all its employees from around the world to fuel its ideas funnel. By leveraging a structured evaluation framework, and a quick “try hard, fail fast” period, projects of interest are then placed in incubation and development towards future successful products and services commercialization.

“This year’s prestigious A.T. Kearney Award given to Gemalto, after highly celebrated global companies such as Air Liquide and L’Oreal, is a prominent acknowledgment of our innovation and continuous improvement efficiency. We also apply the same innovation and virtuous principles to our own processes of idea management and innovation development, in order to maximize the yield of our yearly R&D investments. This commitment to excellence, and dedication to innovation, is crucial to our leadership in digital security” highlighted Olivier Piou, Chief Executive Officer of Gemalto. “Innovation is in our DNA, our methodical approach towards research, experimentation, development and commercialization of cutting-edge technology ensures that Gemalto leverages best-in-class processes and frameworks to deliver superior security, privacy and convenience for its customers, and their end users in the digital world.”

 Coesys Enrolment and Issuance Solutions Named Software Category Finalist

Austin, TX, June 14, 2011–Gemalto (Euronext NL0000400653 GTO), the world leader in digital security, has been selected as a finalist in the software category for TechAmerica Foundation’s American Technology Award for its Coesys Enrolment & Issuance solutions. The award, “The Termans,” bestows the only national “Best Of” distinction that recognizes all technology products and services across the technology industry.

Coesys Enrolment & Issuance solutions combine the software, equipment and integration services for governments to securely capture biometric data, personalize and issue secure documents such as e-passports, health care and identity cards, as well as driver licenses. Coesys offers exclusive security features such as end-to-end encryption and laser sealer, implementing a state-of-the-art key management system capable of addressing specific customer requirements.

“This year we saw a number of nominations from many companies new to the competition,” Dallas Advisory Partners Founder and TechAmerica Foundation Chairman David Sanders said. “Gemalto is recognized for its innovation capacity and contribution to the technology industry by way of premium products and services.”

“Gemalto is honored to be acknowledged for our advancements in personal identity verification,” added Neville Pattinson, vice president of Standards and Government Affairs, Gemalto North America. “Coesys solutions were developed to assist our government customers around the world to strengthen and speed up the transition to using electronic identities, and to ultimately provide citizens with better privacy and better services.”

Nominations for the award were vetted by industry experts and TechAmerica Foundation leadership. The Termans is named after Frederick Terman, who is widely credited as being the father of Silicon Valley. The winners will be presented on June 15 at TechAmerica Foundation’s ninth annual Technology and Government Dinner in Washington, DC. For more information, please visit http://www.techamericafoundation.org/technology-government.

ActivIdentity Offers Enterprise Leaders Three Keys to Success in Addressing Current Outbreak of Security Breaches

Points to Smart Cards, More advanced One-Time-Password Tokens and Device Key Management as Primary Steps to Defending against Advanced Persistent Threats

LONDON, UK. – June 8, 2011 – ActivIdentity Corporation, a global leader in secure identity solutions, recently acquired by HID Global, today unveiled the company’s recommendations to enterprise for strong authentication. The company revealed best practices for avoidingenterprise security breaches, such as Advanced Persistent Threats (APT), which are driving current industry headlines.

APTs concertedly probe the same target for weaknesses, until they get in, then seek to branch out inside an organisation’s network to maximize data theft. While APTs use a variety of tools, recent studies suggest almost half of all data breaches exploit stolen or weak credentials. Once inside, hackers attempt to expand their privilege levels by compromising additional accounts. Too many organisations rely on older-generation perimeter defenses and have weak internal authentication, which is why this strategy has been so effective.

ActivIdentity executives point to three keys to improving enterprise security:

1. Utilise far more secure, easily deployable, affordable and convenient smart card solutions which represent the most logical choice for an authentication device in dealing with most threats. Smart cards control access to PCs, servers, VPNs and potentially cloud-based apps for strong, multi-layered authentication.

2. Employ stronger one-time-password (OTP) tokens with algorithms based on multiple variables (seed key, time, and event counter), which are more resistant to compromise than older traditional tokens, which use fewer variables, hence, less protection.

3. Protect OTP token seed files with strong encryption and initialise tokens and smart card keys locally.

“While no single solution or practice can protect the enterprise from every attack, the current threat matrix unfolding in headlines across the world validates ActivIdentity’s approach in making smart cards readily available, even to medium-sized enterprises, through our ActivID™ CMS appliance,” said Julian Lovelock, ActivIdentity’s senior director of product marketing. “ActivIdentity also offers more advanced OTP tokens leveraging three-variable algorithms (seed keys, time and event data), which are less vulnerable to hacking as well as enabling customers to initialise their own tokens, rather than relying on the keys loaded by the vendor.”

ActivIdentity’s 4TRESS™ Authentication Server enables enterprise to add other protocols to OTP, such as SMS out of band, and offers secure remote access from laptops and smartphones.

“Recent headlines have certainly heightened awareness and concerns about the frequency and cost of targeted attacks, particularly among mid-size to large enterprises,” said Derek Brink, vice president and research fellow for IT Security at Aberdeen Group. “Traditional boundaries between the enterprise IT infrastructure and public IT infrastructure have become so porous – e.g., in support of email, web access, web applications, encapsulated protocols, and mobile devices such as laptops, smartphones and tablets – that although a strong perimeter defense may still be necessary, it is no longer sufficient to protect against the most sophisticated threats."

ActivIdentity begins a blog series in June, which will address the latest breaches and evolving online security threats to enterprise, government and banking.

 IMATION ACQUIRES MXI SECURITY

Transaction Augments Imation’s Strategic Focus in Data Protection Solutions

RSA finally comes clean: SecurID is compromised

By Peter Bright

 RSA Security is to replace virtually every one of the 40 million SecurID tokens currently in use as a result of the hacking attack the company disclosed back in March. The EMC subsidiary issued a letter to customers acknowledging that SecurID failed to protect defense contractor Lockheed Martin, which last month reported a hack attempt.

SecurID tokens are used in two-factor authentication systems. Each user account is linked to a token, and each token generates a pseudo-random number that changes periodically, typically every 30 or 60 seconds. To log in, the user enters a username, password, and the number shown on their token. The authentication server knows what number a particular token should be showing, and so uses this number to prove that the user is in possession of their token.

The exact sequence of numbers that a token generates is determined by a secret RSA-developed algorthm, and a seed value used to initialize the token. Each token has a different seed, and it's this seed that is linked to each user account. If the algorithm and seed are disclosed, the token itself becomes worthless; the numbers can be calculated in just the same way that the authentication server calculates them.

This admission puts paid to RSA's initial claims that the hack would not allow any "direct attack" on SecurID tokens; wholesale replacement of the tokens can only mean that the tokens currently in the wild do not offer the security that they are supposed to. Sources close to RSA tell Ars that the March breach did indeed result in seeds being compromised. The algorithm is already public knowledge.

As a result, SecurID offered no defense against the hackers that broke into RSA in March. For those hackers, SecurID was rendered equivalent to basic password authentication, with all the vulnerability to keyloggers and password reuse that entails.

RSA Security Chairman Art Coviello said that the reason RSA had not disclosed the full extent of the vulnerability because doing so would have revealed to the hackers how to perform further attacks. RSA's customers might question this reasoning; the Lockheed Martin incident suggests that the RSA hackers knew what to do anyway—failing to properly disclose the true nature of the attack served only to mislead RSA's customers about the risks they faced.

Original Appearance:http://arstechnica.com/security/news/2011/06/rsa-finally-comes-clean-securid-is-compromised.ars

Lockheed Martin Suffers Massive Cyberattack

"Significant and tenacious" attack targeted multiple U.S. defense contractors and may have involved hack of RSA SecurID system.

 

Original Appearance: http://www.informationweek.com/news/government/security/229700151 

Android vulnerability exposes users to data theft

Using an Android device on unsecure Wi-Fi can expose your calendar, contacts, and other data to bad guys

By Ted Samson | InfoWorld

Android users running apps over an unsecured Wi-Fi network run the risk of having their authentication tokens swiped by eavesdroppers. Those tokens can be used to secretly view and tamper with your contacts, calendars, email, and other information, according to research from University of Ulm.

The bad news: Smartphones running Android 2.3.3 or earlier -- which accounts for 99.7 percent of Android devices -- are most vulnerable. The good news: Developers, users, and Google can take steps to reduce the risks.

The vulnerability can affect apps that access Google services, such as Calendar or Contacts, via the ClientLogin authentication protocol, according to the researchers. Using ClientLogin, an app requests an authentication token from the associated Google service. That authToken can be conveniently (from a user perspective) repurposed for subsequent service requests for two weeks.

The problem is, if the authToken is used in a request sent via an unencrypted insecure connection (HTTP instead of HTTPS), an eavesdropper can grab it and use it for that 14-day period to get at user data made available through the service. Compounding the problem, the authTokens aren't bound to any session or device-specific information.

Thus, "[an] adversary can gain full access to the calendar, contacts information, or private web albums of the respective Google user," according to the researchers. "This means that the adversary can view, modify or delete any contacts, calendar events, or private pictures. This is not limited to items currently being synced but affects all items of that user."

A hacker could collect a large store of tokens by first setting up a Wi-Fi access point with the same SSID of an unecrypted wireless network, such as one a user might access at the airport or the local coffee shop. Any Android device set to automatically connect to a previously known network would attempt to sync automatically when in range. Whether or not the hacker opted to forward the request, he or she would be able to capture authTokens.

Beyond being able to view user data, a hacker could use the token to tweak a victim's contacts list to, for example, alter an email address or group so that the user would inadvertently send messages to an unintended recipient.

The researchers tested out apps that contact Google services, including Calendar, Contacts, and Gallery, on various iterations of Android. They found that those apps were all vulnerable on devices running Android 2.3.3 or earlier. On Android 2.3.4 and later, Calendar and Contacts use a secure HTTPS connection, though the Gallery app -- which syncs with Picasa online Web albums -- does not. More important, the vulnerability is not limited to standard Android apps; any Android or desktop app that accesses Google services via ClientLogin over HTTP is vulnerable.

The researchers offer several suggestions for fixing the vulnerability. App developers whose apps and services use ClientLogin should switch to HTTPS. They should also switch to more secure authentication services, such as oAuth.

Google, the researchers advise, should limit the lifetime of authTokens. Google services should be tweaked to reject ClientLogin-based requests over insecure HTTP connections.

Android users should update to Version 2.3.4 of the OS, though the update is not immediately available for all phones. Additionally, users should switch off the set that permits automatic synchronization with open Wi-Fi networks. The best protection at the moment, according to the researchers, "is to avoid open Wifi networks at all when using affected apps."

Original Appearance:  http://www.infoworld.com/t/mobile-security/android-vulnerability-exposes-users-data-theft-309

Biometrics, PIV-I on the horizon for airports

Industry executives moving ahead with new ID technologies?

After the Sept. 11 terrorist attacks airport security was of the utmost concern. There was a lot of discussion around personnel vetting and using biometrics and other high-tech security to enable access to secure areas.

The Transportation Worker Identification Credential was originally envisioned for workers at all transportation hubs–seaports, railways and airports. But lobbying from airport executives killed the TWIC for that industry application. The common refrain about standardizing access control and credentialing at airports was, “if you’ve seen one airport, you’ve seen one airport.”

Original appearance:  http://www.secureidnews.com/2011/05/25/biometrics-piv-i-on-the-horizon-for-airports

More than 1.5 billion smart credentials to ship in the next three years

Smart card credentials along with biometrics are seeing an uptake in adoption worldwide. ABI Research estimates that about 1.5 billion smart credentials will be issued through 2014.

Governments are adopting the credential to help combat fraudulent and criminal activities, improve return on investment and bundle several applications in one document to create efficiencies for government departments and make the documents more user-friendly, flexible, and secure for citizens

Click here to view the original publication by SecureIDNews.

Thales payShield 9000 awarded Best Secure Transaction Solution by SC Magazine

Weston, FL and Cambridge, UK – 17 May 2011 – Thales, leader in information systems and communications security, announces its payShield 9000 Hardware Security Module (HSM) has won SC Magazine’s award for Best Secure Transaction Solution. The magazine’s annual awards for the European information security industry recognise those vendors at the forefront of innovative security technology delivery.

Thales’s payShield 9000 was acknowledged for its world-leading cryptographic performance and resiliency. Designed specifically to secure card payment systems, Thales’s next generation HSM for payment security systems is a high-performance tamper-resistant security platform that protects cryptographic keys and other sensitive information such as customer PINs and cardholder data.

 

“Growing transaction volumes, an increase in the amount of data that needs to be protected with the introduction of PCI DSS, and a move from static to dynamic authentication (SDA to DDA) EMV cards require a huge increase in cryptographic processing power, resulting in a massive change in the need for payments card HSMs,” says Franck Greverie, Thales vice president in charge of information technology security activities. “For more than 20 years Thales has been at the forefront of security and payments technology. payShield 9000 further demonstrates our commitment to delivering innovative and high quality security solutions and this has been recognised with this SC Magazine award.”

Thales payment HSMs protect more than 70% of the world’s card payments. payShield 9000 is the first payment HSM to meet the resilience needs of modern data centres with dual power supplies, and once installed can be managed entirely remotely reducing operational costs and the inconvenience of on site management. Its superior cryptographic processing at 1500 transactions per second (TPS) satisfies the ever increasing demand for performance, and its software packages are configured specifically for card issuers or transaction processors meaning they can purchase exactly what they require.

For Further information on payShiled 9000, click here.

Original Appearance: http://www.realwire.com/releases/Thales-payShield-9000-awarded-Best-Secure-Transaction-Solution-by-SC-Magazine

SCM Microsystems' SCL011 Contactless Reader Achieves CCID Compliance

ISMANING, Germany, May 12, 2011 (GLOBE NEWSWIRE) -- SCM Microsystems, a leading provider of solutions for secure access, secure identity and secure exchange, today announced that its SCL011 contactless smart card reader is now compliant with the CCID (Circuits Cards Interface Devices) standard, making it easy to plug in and use the device without the need to install specific drivers.

"CCID has been an industry standard for contact readers for some time and now is also becoming a standard for the growing number of contactless and RFID smart card readers," said Dr. Manfred Mueller, chief executive officer of SCM Microsystems. "With 500,000 devices deployed to date for Germany's electronic ID program, the SCL011 has already demonstrated high quality and compliance to industry standards. CCID compliance and the ability to use the reader without installing special drivers furthers its appeal."

SCL011 contactless reader

The SCL011 is especially designed for 13.56MHZ contactless smart card applications and supports electronic ID, payment and public transportation schemes, as well as interaction with NFC-enabled devices. The reader offers best-in-class interoperability with various smart card chips and applications and is fully capable of reading and writing NFC Forum compliant tags, based on MIFARE, FeliCa and Topaz. Field-upgradeable firmware makes the SCL011 a secure and future-proof investment, providing both flexibility and fast time-to-market for new applications while minimizing risks associated with evolving technology standards.

About SCM Microsystems

SCM Microsystems, a business unit of Identive Group, Inc. (Nasdaq:INVE) (Frankfurt:INV), is a leading provider of solutions for secure access, secure identity and secure exchange. The company offers the world's broadest range of contact, contactless and mobile smart card reader and terminal technology, digital identity and transaction platforms, as well as systems that integrate physical and logical access control. SCM's smart card-based products and solutions are utilized around the world to enable security and identification applications, transaction systems, eHealth- and eGovernment programs and physical access systems. More information atwww.scmmicro.com.

Sony PlayStation Suffers Massive Data Breach

(Reuters) - Sony suffered a massive breach in its video game online network that led to the theft of names, addresses and possibly credit card data belonging to 77 million user accounts in what is one of the largest-ever Internet security break-ins.

Sony learned that user information had been stolen from its PlayStation Network seven days ago, prompting it to shut down the network immediately. But Sony did not tell the public until Tuesday.

The electronics conglomerate is the latest Japanese company to come under fire for not disclosing bad news quickly. Tokyo Electric Power Co was criticized for how it handled the nuclear crisis after the March earthquake. Last year, Toyota Motor Corp was slammed for being less than forthright about problems surrounding its massive vehicle recall.

The "illegal and unauthorized person" obtained people's names, addresses, email address, birth dates, usernames, passwords, logins, security questions and more, Sony said on its U.S. PlayStation blog on Tuesday.

The shutdown of the PlayStation Network seven days ago prevented owners of Sony's video game console from buying and downloading games, as well as playing with rivals over the Internet.

Alan Paller, research director of the SANS Institute, said the breach may be the largest theft of identity data information on record.

The breach is a major setback for the Japanese electronics maker. Although video game hardware and software sales have declined globally, the PlayStation franchise has been a steady seller and remains a flagship product for Sony.

Children with accounts established by their parents also might have had their data exposed, Sony said.

Sony said it saw no evidence credit card numbers were stolen, but warned users it could not rule out the possibility.

"Out of an abundance of caution, we are advising you that your credit card number (excluding security code) and expiration date may have been obtained," Sony said.

Analysts said that, while Sony has notified its customers of the breach, it still has not provided information on how user data might have been compromised.

"This is a huge data breach," said Wedbush Securities analyst Michael Pachter, who estimated Sony generates $500 million in annual revenue from the service. "The bigger issue with Sony is how will the hacker use the info that has been illegally obtained?"

Sony said it has hired an "outside recognized security firm" to investigate.

The company said user account information for the PlayStation Network and its Qriocity service users was compromised between April 17 and April 19.

Paller said Sony probably did not pay enough attention to security when it was developing the software that runs its network. In the rush to get out innovative new products, security can sometimes take a back seat.

"They have to innovate rapidly. That's the business model," Paller said. "New software has errors in it. So they expose code with errors in it to large numbers of people, which is a catastrophe in the making."

He suspected the hackers entered the network by taking over the PC of a system administrator, who had rights to access sensitive information about Sony's customers. They likely did that by sending the administrator an email message that contained a piece of malicious software that got downloaded onto his or her PC.

Hackers have stolen personal data in the past from large companies. In 2009, Albert Gonzalez pleaded guilty to stealing tens of millions of payment card numbers by breaking into corporate computer systems at companies such as 7-Eleven Inc and Target Co.

Sony said its users could place fraud alerts on their credit card accounts through three U.S. credit card bureaus, which it recommended in its statement.

Sony, a unit of Sony Corp, said it could restore some of the network's services within a week.

The company declined to comment on whether it was working with law enforcement or other parties in its investigation.

The online network was launched in the autumn of 2006 and offers games, music and movies to people with PlayStation consoles. It had 77 million registered users as of March 20, a Sony spokesman said.

(Reporting by Liana B. Baker; additional reporting by Jim Finkle in Boston; editing by Robert MacMillan, Kenneth Li, Bernard Orr and Andre Grenon)

Auto Locking Keyboard
Secure your desktop by simply walking away!

Oakland, California- April 18,2011- Key Source International- A global leader in desktop and
enterprise security solutions is proud to announce a companion instructional video for the popular
The SonarLocID® Keyboard. There is no product available today that makes it easier to secure
sensitive information at the desktop, like the SonarLocID® keyboard, by simply walking away!

“Based on demand, it was essential to produce an instructional video to graphically show just how
easily this product is to program.” Says, Phil Bruno VP of Marketing at KSI.

Out of the box the SonarLocID® keyboard seamlessly works with Windows XP and Win 7. But what makes this product truly amazing is how it can be configured to interface into hundreds of specialized
security applications. The instruction video demonstrates how to program range and timing, how
to enter custom commands, as well as adding sequenced keystrokes for hands free automation
of both walk away and walk up functionality. Because the SonarLocID® keyboard requires no
server or client license the instructional video details how simple it is to save your programmed
settings to a file and upload it to the onboard firmware of the keyboard.

No user license, no server license. Just a simple utility that letʼs you control your desktop, secure
your sensitive information and helps you meet regulatory compliance.

Key Source International; Security Without Compromise.
http://www.youtube.com/watch?v=kJcX0YbOXx4

Key Source International has over 30 years of experience delivering high-end technology solutions to
Fortune 1000 companies and system integrators worldwide.
For additional information contact Deanne Vankirk, 1-800-722-6066
mailto:deannev@ksikeyboards.com or info@ksikeyboards.com http://www.ksikeyboards.com
Corporate address: 7711 Oakport Street, Oakland, CA 94621

White House finalizes online identity strategy

Written By: Angela Moscaritolo

Following nearly a year of consultation with public and private sector stakeholders, the Obama administration on Friday released the final version of its National Strategy for Trusted Identities in Cyberspace (NSTIC).

The strategy, first unveiled in draft form in June, lays out a roadmap for the public and private sectors to build an "ecosystem," whereby the identities of individuals, organizations, networks, services and devices involved in online transactions can be trusted, according to the final document.

But while parts of this exist today, achieving the entire plan is years away, according to experts.

Members of the private sector, aided by the government, will be responsible for developing and implementing technologies, standards and policies to implement the proposal.

“The old password and username combination we often use to verify people is no longer good enough,” said Commerce Secretary Gary Locke, during Friday's unveiling of the strategy at the U.S. Chamber of Commerce. “It leaves too many consumers, government agencies and businesses vulnerable to identity and data theft.”

As part of the strategy, individuals would be able to voluntarily obtain a secure credential – such as a piece of software on their smartphone, or a smart card or a token that generates a one-time password – from their choice of public and private sector identity providers. This credential would be used for online authentication when banking, accessing electronic health records, sending email and making online purchases.

Since users would be able to choose from a variety of credential providers, there would be no single, centralized database of user information, the White House said in a news release Friday.

The strategy has received widespread support from private sector companies, such as PayPal, Microsoft and Adobe; advocacy and academic organizations, such as the Center for Democracy and Technology, and the American Bar Association; as well as members of Congress.

One such advocate, Steven Sprague, CEO of authentication and encryption solutions provider Wave Systems, told SCMagazineUS.com on Friday that to facilitate such an environment, banks, health care, email and cloud service providers will need to offer consumers the option of using strong authentication credentials.

If realized, an identity ecosystem would provide tremendous benefits and convenience to users, he said.

For example, individuals could have an electronic identity that could be used when conducting online transactions, he added. They also could have more than one identity – one for personal use, another for business.

“I [would] have no more passwords to remember,” Sprague said. “When I go to open an account, instead of making a new username and password, I can bring an existing credential I already know, and say, 'Use this account.'”

Moreover, identity service providers would help users manage their identities over time, making it easier for individuals to keep track of where they have opened and closed accounts, he said.

Others, however, said the strategy may do more harm than good. According to a paper, released Friday by data leakage prevention software maker Identity Finder, "powerful identity credentials," as are being proposed, could enable “hyper-identity theft.”

To mitigate this issue, Identity Finder executives recommend that complementary federal regulations be enacted, mandating that all ecosystem participants implement a set of baseline information security and privacy protocols. The regulation should also include provisions to educate individuals on how to properly safeguard their identity credentials.

The National Institute of Standards and Technology plans to hold a series of workshops to help the private sector, consumer advocates and other groups advance the NSTIC strategy.

HID Global , trusted leader in solutions for the delivery of secure identity in conjunction with ActivIdentity , a recently acquired HID Global company, today announced the release of ActivEntry 2.4. The solution is part of HID's federal identity compliance initiative that combines HID Global and ActivIdentity products and services to meet Personal Identity Verification (PIV) standards and certifications as mandated by Homeland Security Presidential Directive 12 (HSPD-12). ActivEntry enables Federal Agencies to comply with OMB M 11-11's requirements to secure physical access to buildings with the PIV card.

The company's latest release adds a new service application programming interface (API), enabling Physical Access Control Systems (PACS) vendors to integrate enrollment capability directly to ActivEntry's Validation Service. ActivEntry 2.4 also expands Personal Identification Verification (PIV) card support to include PIV-I (PIV-interoperable) and PIV-C (PIV-compatible) for cards issued by non-federal entities.

"ActivEntry2.4's new Validation Service API provides HID Global's government customers with the tightest level of access control integration possible," said Jerome Becquart, general manager of ActivIdentity , part of HID Global. "This level of integration will leverage an agency's existing access control system for common operations and enrollment, which greatly reduces the deployment costs and improves the user experience."

The PACS solution's enroller feature automatically pushes card enrollments to ActivEntry, making ActivEntry Enroller completely optional and necessary only for stand-alone operations or configurations where an access control system is not integrated with the new API. ActivEntry 2.4 also integrates reader configuration and audit management into the access control console.

ActivEntry 2.4 add supports for PIV-I and PIV-C cards in compliance with NIST (National Institute for Standards and Technology) Special Publication 800-73-3 , which uniquely identifies cards by a Universally Unique Identifier (UUID) instead of a FASC-N (Federal Agency Smart Credential Number) used for PIV cards.

Original Appearance:  http://www.securityinfowatch.com/hid-global-simplifies-access-control-integration-government-agencies-with-activentry-24 

HID Global Unveils U.S. Federal Identity Compliance Initiative for Physical Access Control at ISC West 2011

Demonstrates How Agencies Can Cut Cost and Complexity of FIPS 201 Compliance Using Modular Approach and Industry’s Only Turnkey Offering From a Single Supplier

HID Global, trusted leader in solutions for the delivery of secure identity, today announced it will be demonstrating the first in a planned family of simple-to-deploy, cost-effective, turnkey FIPS 201 compliance solutions at ISC West 2011. The company’s Federal Identity Compliance Initiative will make it easier for federal agencies to upgrade an existing physical access control system (PACS) to support recently mandated government identity-verification standards.

HID Global’s federal compliance initiative combines the company’s strengths in access control solutions and technology migration, the enhanced cryptographic security of its next-generation reader platform, and the extensive identity-assurance portfolio it acquired from ActivIdentity, a recently purchased HID Global company. Customers will be able to deploy HID Global readers that are seamlessly integrated with its ActivIdentity ActivEntry upgrade modules, and achieve full FIPS 201 compliance without having to replace their current physical access control head-end server, panel or door control hardware. 

According to a February 2011 memorandum issued by the U.S. Department of Homeland Security (DHS) and the Office of Management and Budget (OMB), existing physical and logical access control systems must be upgraded to use Personal Identification Verification (PIV) credentials in accordance with National Institute of Standards and Technology (NIST) guidelines, before federal agencies may use development and technology refresh funds to complete other activities. HID Global’s Federal Identity Compliance Initiative will speed and simplify compliance, offer a migration path from legacy to PIV credentials, and provide a modular hardware approach that makes it easier for agencies to respond to regulatory changes, modify security levels in selected areas as required, and take advantage of ongoing advances in access-control technology. 

“HID is uniquely positioned to serve this critical government market need,” said Brad Jarvis, Vice President of Strategic Product Initiatives with HID Global. “Our Federal Identity Compliance Initiative gives agencies the confidence that they can achieve compliance quickly, effectively and with all necessary audit support, on an incremental, pay-as-you-go basis that preserves investments in their existing infrastructure. We will be extending our next-generation reader platform with a variety of modular hardware options that enable agencies to very flexibly address compliance requirements across all PIV access-area permission levels.” 

HID Global’s next-generation readers use EAL5+ Secure Element (SE) hardware for tamper-proof protection of keys and cryptographic operations, and the industry-standard Open Supervised Device Protocol (OSDP) to establish a seamless and secure, bidirectional communications link with the company’s ActivEntry hardware modules. This creates a fully tested and validated, turnkey solution for upgrading an existing physical access control infrastructure so that it can authenticate PIV credentials across the full range of assurance levels as defined by the federal government’s Special Publication 800-116 (SP800-116). The most recent ActivEntry 2.4 offering also adds a new service application programming interface (API) that integrates PACS enrollment capability directly into the validation service. 

HID Global plans to expand its offering to address all SP800-116 access permission levels, including Controlled, Limited and Exclusion areas. To showcase the capabilities HID Global will offer during the first two deployment phases of its Federal Identity Compliance Initiative, the company will be featuring its coming, next-generation access control platform, the iCLASS SE reader, in the following demonstrations at ISC West 2011: 

 Controlled access compliance: This solution will show how HID Global’s next-generation access control platform supports Card Authentication Key (CAK) Certificate access and delivers access permissions to Controlled areas per SP800-116 requirements.

Contact and biometric compliance: This solution will enable PIV authorization certificate access, which delivers access permissions to Controlled, Limited and Exclusion areas per SP800-116 requirements. 

HID Global will be offering its Federal Identity Compliance Initiative product family through its proven network of physical access control channel partners. The initiative is backed by the company’s Genuine HID value proposition, which stresses the highest levels of global product quality and delivery performance. HID Global also plans to extend the program beyond FIPS 201 to support Public Key Infrastructure (PKI)-at-the-door compliance and also PIV-I and PIV-C (PIV-compatible) requirements for cards issued by non-federal entities..

original appearance: http://www.bradenton.com/2011/04/05/3089089/hid-global-unveils-us-federal.html

Common Access Card continues to pave the way

It was 10-year ago this past October when the first U.S. Defense Department Common Access Card was issued. Since then the largest U.S. agency has issued 24 million of the smart card-based secure credentials.

In that time the staff at the Defense Manpower Data Center (DMDC), the group within DOD responsible for issuing the card, went from simply issuing an ID card to truly managing with identity, says Mike Butler, deputy director of identity services at the DMDC.

Butler was with the Defense Department when it first issued the credential and rejoined the agency in August 2010 after three years away.

original appearance: http://www.secureidnews.com/2011/04/04/common-access-card-continues-to-pave-the-way

Gemalto Innovation Receives Sesames Award at CARTES in Asia 2011

Gemalto further demonstrates industry leadership with "Smart Badge Holder"

CARTES in Asia, Hong Kong - Mar 30, 2011 - Gemalto (Euronext NL0000400653 GTO), the world leader in digital security, continues to demonstrate its innovation leadership with the announcement that its Smart Badge Holder has won the Sesames Award at CARTES in Asia 2011.
The Sesames Awards granted in Europe and Asia each year celebrate the unique contribution and investment of leading industry players like Gemalto in developing next generation products and solutions for the digital age.

The smart badge holder
In a world where enterprises and their workforce are going more and more mobile, Gemalto’s smart badge holder enables the use of their corporate badge to provide secure logical access on mobile devices such as smartphones. By simply inserting their badge in the wireless Smart Badge Holder, corporate users will be able to access their encrypted e-mails and to sign their documents electronically from their smartphones in the same way they do on their desktop PC with a conventional wired card reader.
 
Enterprises will be able to leverage their existing corporate badges infrastructure and bring security to smartphones and tablet PCs.

About Gemalto

Gemalto (Euronext NL 0000400653 GTO) is the world leader in digital security with revenues of €1.9 billion in 2010, and over 10 thousand employees operating out of 87 offices and 13 Research & Development centers in 45 countries.

Gemalto is at the heart of our evolving digital society. The freedom to communicate, travel, shop, bank, entertain, and work—anytime, anywhere—has become an integral part of what people want and expect, in ways that are convenient, enjoyable and secure.

Gemalto delivers on the growing demands of billions of people worldwide for mobile connectivity, identity and data protection, credit card safety, health and transportation services, e-government and national security. We do this by supplying to governments, wireless operators, banks and enterprises a wide range of secure personal devices, such as subscriber identification modules (SIM), Universal Integrated Circuit Card (UICC) in mobile phones, smart banking cards, smart card access badges, electronic passports and USB tokens for online identity protection. Moreover Gemalto delivers on emerging applications related to the ‘Internet of things’ by supplying wireless modules and machine identification modules (MIM) for machine-to-machine communication. To complete these solutions we also provide software, systems and services to help our customers achieve their goals.

As the use of Gemalto’s software and secure devices increases with the number of people interacting in the digital and wireless world, the company is poised to thrive over the coming years.

For more information visit www.gemalto.com, blog.gemalto.com, or follow @gemalto on Twitter.

RSA: Cyberattack could put customers at risk

Information about RSA's SecurID authentication tokens used by millions of people, including government and bank employees, was stolen during an "extremely sophisticated cyberattack," putting customers relying on them to secure their networks at risk, the company said today.

"Recently, our security systems identified an extremely sophisticated cyberattack in progress being mounted against RSA," Executive Chairman Art Coviello, wrote in an open letter to customers, which was posted on the company's Web site.

"Our investigation has led us to believe that the attack is in the category of an Advanced Persistent Threat. Our investigation also revealed that the attack resulted in certain information being extracted from RSA's systems. Some of that information is specifically related to RSA's SecurID two-factor authentication products," the letter said.

"While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers, this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack," Coviello wrote. "We are very actively communicating this situation to RSA customers and providing immediate steps for them to take to strengthen their SecurID implementations."

The company said it has no evidence that other products are affected or that personally identifiable data on customers or employees was compromised. RSA, the security division of technology giant EMC, did not elaborate and a spokesman said he could not provide additional information at this time.

The tokens, of which 40 million have been deployed, and 250 million mobile software versions, are the market leader for two-factor authentication. They are used in addition to a password, providing a randomly generated number that allows a user to access a network.

The tokens are commonly used in financial transactions and government agencies; one source who asked to remain anonymous said SecurID users in those sensitive areas were scrambling to figure out what to do in light of the breach.

What exactly did the bad guys get?
 

Because it's unclear exactly what type of information was stolen, sources told CNET they could only speculate as to what the potential outcome could be for companies using the devices.

"It's hard to say [how serious the breach is] until we know the extent of what the bad guys got a hold of," said Charlie Miller, a principal analyst at consultancy Independent Security Evaluators. "Any time a security company gets broken into, it reminds you that it could happen to anybody."

He used to work for a financial services firm that "basically ran everything on" SecurID, he said. "They would be very unhappy if they found out" it could be compromised somehow.

"The real story here is what was stolen. It definitely seems mysterious," said Ravi Ganesan, an operating partner at The Comvest Group and former founder and CEO of single sign-on provider TriCipher. "SecurID is a token authenticator device that flashes a new number every 60 seconds. The number is calculated from two things, a 'secret seed' unique to that device and the time of day. So your one-time password is output of [that] algorithm."

RSA has historically kept their algorithm secret, but that is not a good defense against a sophisticated attacker who could get a software version of the token or the back-end server and reverse engineer the code, Ganesan said. "So what on earth could have been stolen? I certainly hope RSA did not put some back door into the software and that was what got stolen."

While details were scarce, hints about the breach could be gleaned from a message to customers filed with the SEC. It recommended that customers increase focus on security for social-media applications and Web sites accessed by anyone with access to their critical networks; enforce strong password and PIN policies; as well as remind employees to avoid opening suspicious e-mails and providing usernames or other credentials to people without verifying the person's identity as well as avoid complying with e-mail or phone-based requests for such information.

Additionally, the message said customers should pay special attention to securing their active directories and use two-factor authentication to control access to them; watch closely for changes in user privilege levels and access rights; harden monitor and limit remote and physical access to infrastructure that hosts critical security software; shore up practices against social-engineering attacks; and update security products and patch operating system software.

Advanced Persistent Attacks often target source code and other information useful in espionage and involve knowledge of the company's network, key employees, and workings. Attackers use social engineering and exploits hidden in e-mail and other messages to sneak keyloggers and other snooping tools onto employees' computers. Google announced last year that it and other companies had been targeted in such an attack and it later came out that attackers used an unpatched hole in Internet Explorer to get into the company computers. Google said at the time that intellectual property was stolen and that the attacks appeared to originate in China.

A Global Bank Chooses OpenTrust MFT for Secure Document Exchange

PARIS--(BUSINESS WIRE)--OpenTrust, the Next-Gen IT security software publisher, today announced that one of Europe’s biggest financial institutions has chosen to implement OpenTrust MFT to securely exchange documents of all sizes.

“This bank required a secure, multi-entity and multi-purpose document exchange solution. OpenTrust® MFT, satisfies all these requirements, providing a secure platform for centralized electronic exchanges, optimizing business processes and increasing productivity”

The client is a leading financial institution present in all banking activities (retail, corporate, investment) with thousands of branches in 70 countries worldwide.

The bank’s immediate benefits are:

• End-to-end confidentiality of all file exchanges
• A highly customizable solution, simple to use, implement and operate
• Management of files of all types and size (no limit)
• Full traceability of actions

Today, the communication needs of all organizations, from small companies to multinational organizations, involve the transfer of large volumes of data both internally and externally. Traditional email systems cannot cope with large files and alternative FTP services are both time-consuming and costly to administer when deployed to a large numbers of users. Secure, auditable, cost-effective file exchange is therefore high-priority for all organizations.

OpenTrust MFT (Managed File Transfer) is an all-inclusive solution for securing exchanges of files of all types and sizes in accordance with organizational procedures and security policies. In addition to a friendly, fully-customizable GWT™-based user interface, the solution features strong file encryption capabilities, a fine-grained access control model for efficient and secure delegation of management across branches and built-in reporting and auditing tools. Authentication schemes, exchange rules and policies are all controlled per user profile via a full-featured web-based administration module. The solution is available as traditional licensed software or as SaaS via the OpenTrust Private Cloud.

“This bank required a secure, multi-entity and multi-purpose document exchange solution. OpenTrust® MFT, satisfies all these requirements, providing a secure platform for centralized electronic exchanges, optimizing business processes and increasing productivity”, said Hervé Lecart, Associate Director of Online Services.

OpenTrust will be presented as a partner solution by Steria at InfoSecurity Belgium on 23-24 March 2011

Auto Locking Keyboard Protects Sensitive Data

Oakland, California- January 31,2011- Key Source International- A global leader in desktop and enterprise security solutions is proud to announce it will be demonstrating its newest addition to its line of security products at the 2011 RSA Conference, the SonarLocID®, integrated keyboard. The Show will take place at the Moscone Center in San Francisco February 14-18 2011.

The SonarLocID® Keyboard solves security risks and privacy concerns with unattended computers. The SonarLocID® keyboard uses state of the art integrated presence detection technology to identify that a user is physically present. The workstation will remain active as long as the user is present, but will securely lock when the user physically steps away, usually one meter or less from the sonar detector. Distance and timing are set by the SonarLocID® software utility. Upon return the SonarLocID® will prompt you for your user name, password or proximity badge or for truly Advanced Authentication combine the SonarLocID® with fingerprint biometrics.

“The need for Information security and protecting corporate data along with meeting government compliance is more of an imperative than ever. Leaving an unattended computer open with sensitive company data or patient information for all to see could cost your employer millions of dollars, in fines and stolen intellectual property. Or worst yet, It could cost YOU your job!” – says Phil Bruno, VP of Marketing at Key Source International.

The SonarLocID® keyboard easily attaches to the PC via a USB port and comes with a programming utility that allows for custom keystrokes and delays to be programmed by the user to send a sequence to lock the computer when the user walks away. In addition you can easily program commands for walk up prompts for re-authentication. No software is deployed on the client or server, just simple onboard configurable flash memory that hold user definable keystrokes, delays and settings. The SonarLocID® keyboard can be programmed to work seamlessly with most of the popular enterprise single sign on and web based security applications. Typical applications are pharmacy, healthcare, banking, government and HIPAA compliance.

Key Source International has over 30 years of experience delivering high-end technology solutions to Fortune 1000 companies and system integrators worldwide. 

SafeNet Delivers Cloud-based Encryption to Amazon Web Services Customers

BALTIMORE--(BUSINESS WIRE)--SafeNet, Inc. a global leader in information security, today announced that its server- and storage-based encryption will be available for the Amazon Elastic Compute Cloud (Amazon EC2) and the Amazon Virtual Private Cloud (Amazon VPC). SafeNet’s solutions provide a series of data security controls that can be implemented by customers to help meet compliance requirements, including the new Payment Card Industry Data Security Standard (PCI DSS) 2.0. These technologies include pre-launch authentication, storage encryption and key management for cloud environments.

“We’re pleased to help our joint customers take advantage of SafeNet’s data encryption and key management for their applications running in the scalable and dynamic AWS environment”

With SafeNet ProtectV™ server- and storage-based encryption, customers can encrypt compliance-impacted data running on Amazon EC2 and Amazon Elastic Block Store (Amazon EBS) volumes.

“We’re pleased to help our joint customers take advantage of SafeNet’s data encryption and key management for their applications running in the scalable and dynamic AWS environment,” said Terry Wise, Director of Business Development, Amazon Web Services LLC. “AWS provides businesses and developers around the world with highly reliable and secure technology infrastructure so they can instantly acquire compute power, storage, and other on-demand services in the cloud.”

SafeNet’s ProtectV™ Instance server-based encryption allows enterprises to manage a host of virtual services and control pre-launch authentication and authorization running in cloud environments. With SafeNet’s ProtectV™ Volumestorage-based encryption, customers can encrypt block-level storage volumes to safeguard compliance-impacted information such as PII or cardholder data.

“With cloud computing, security is a shared responsibility between the cloud provider and customers,” said Russ Dietz, CTO, SafeNet. “We’re excited to work with Amazon Web Services to help our customers safeguard and control data and user access in a provable, evidentiary manner in transit and at rest.”

About the SafeNet Trusted Cloud Fabric

SafeNet delivers a complete cloud fabric for virtualized environments, enabling enterprises to ensure trust throughout the lifecycle of enterprise data. The SafeNet Trusted Cloud Fabric™ represents a complete ecosystem that weaves together persistent protection, elastic encryption, anchored identity, and secured communication. With these capabilities, SafeNet brings trust to customers by delivering ownership and control over how data is isolated, protected, and shared—even in multi-tenant cloud environments. An extension of SafeNet Information Lifecycle Protection, the SafeNet Trusted Cloud Fabric™ enables customers to seamlessly integrate any cloud model into their near-term and long-term security strategies.

For more information, visit www.safenet-inc.com/cloudsecurity

About SafeNet, Inc.

Founded in 1983, SafeNet is a global leader in information security. SafeNet protects its customers’ most valuable assets, including identities, transactions, communications, data and software licensing, throughout the data lifecycle. More than 25,000 customers across both commercial enterprises and government agencies and in over 100 countries trust their information security needs to SafeNet.

Seattle Children's Hospital Deploys Gemalto Strong Authentication Solutions to Protect Network Data

HIMSS11 Annual Conference and Exhibition, Orlando, Florida - Feb 21, 2011 - The Seattle Children’s Hospital and Gemalto, the world leader in digital security, today announced that Seattle Children’s Hospital has implemented Gemalto’s Protiva security solutions, including the Strong Authentication Server, two factor authentication devices and technical support services, to securely access its servers, networks and VPNs.  Seattle Children’s Hospital, ranked one of the best children's hospitals in the country by U.S. News & World Report. It will equip 4,500 clinicians and IT administrators with Gemalto’s convenient portable multifactor authentication capability.
 
The hospital selected Gemalto’s Protiva .NET solution to leverage the intrinsic “plug and play” capabilities of their existing Microsoft infrastructure.  This included the flexibility to deploy three types of .NET devices provisioned and managed through Protiva Strong Authentication Server - the .NET USB key, the .NET Dual token, and the Easy OTP token, effectively replacing all legacy tokens.
 
“We view Gemalto as a long-term partner as our organization and data security needs continue to change,” said Mike Kindle, senior director, Enterprise Architecture for Seattle Children’s Hospital. “With Protiva, we have the access protection we need today, a cost-effective path to PKI, and the flexibility to evolve our security technology to meet future requirements.”
 
Gemalto’s flexible Protiva suite contains secure smart card technology to provide hospital staff with two factor strong authentication for authorized user access to the hospital network. They can use either one-time passwords or public key infrastructure (PKI) as the underlying authentication technology, and offers digital signature capabilities.
 
“Securing patients data privacy, information access and capturing an audit trail of all access events is vital to any healthcare organization,” added Tom Flynn, vice president, Online Authentication and eBanking for Gemalto North America. “By choosing Gemalto, Seattle Children’s Hospital can ensure a smooth strong authentication deployment, tailored to the needs of the hospital’s diverse users. This includes providing the same high level of access security even when an authorized user is accessing from a remote location.”
 
Gemalto will be demonstrating its strong authentication solutions at HIMSS11 Annual Conference and Exhibition, Booth #3017, February 20 – 24, 2011 in Orlando, Florida. 

Read More >>

IRVINE, Calif.--(BUSINESS WIRE)--HID Global, trusted leader in solutions for the delivery of secure identity, today announced that its HID on the Desktop™ solution for information access systems has earned five out of five stars in SC Magazine’s January 2011 Multifactor Authentication Group Test. HID on the Desktop includes Genuine HID™ credentials, OMNIKEY^® readers and naviGO™ 1.0 SP3 management software, offering organizations a secure and convenient two-factor PC logon solution for end users. HID Global earned a perfect score across SC Magazine’s performance, documentation and support categories.

“a strong option for an enterprise-class deployment where combining access control and multifactor authentication can deliver cost benefits and simplify the amount of devices users must maintain.”

HID on the Desktop provides organizations a convenient and secure solution for end-users to access both buildings and the computer network while also optimizing the investment in an organization’s existing physical access control system. According to SC Magazine, HID on the Desktop offers “a strong option for an enterprise-class deployment where combining access control and multifactor authentication can deliver cost benefits and simplify the amount of devices users must maintain.”

HID cards are already the standard for physical access control at Fortune 1000 corporations worldwide, and SC Magazine elaborated that “an added benefit of working with the HID solution is that users with individual contactless HID iCLASS^® cards or HID Prox cards already in use for the door access system can now use these cards for both physical access and to logon to their respective PCs, according to their privileges stored in naviGO.”

The HID on the Desktop award-winning solution has been previously recognized as Security Product of the Year, Business Continuity category, by Security Products magazine, and has received the Outstanding Smart Card Achievement Award, Technology category by the Smart Card Alliance. HID Global will be demonstrating HID on the Desktop along with its full line of readers and credentials at RSA Conference 2011, February 14-18, in booth #823 at the Moscone Center in San Francisco, California.

HID on the Desktop Overview

HID on the Desktop allows organizations to leverage existing physical access cards to deploy security for computer networks using smart card technology, PKI and digital certificate standards. As a three-component solution – Genuine HID contact and contactless smart cards, OMNIKEY readers and naviGO credential management software – HID on the Desktop provides corporate enterprises and government agencies with the flexibility to deploy the most “risk-appropriate” authentication solution for secure PC logon based on their unique security requirements. The HID Global portfolio is extended through the acquisition of ActivIdentity, which brings a broad set of authentication products. These products enable organizations to securely issue and manage smart cards, tokens, and other types of credentials for secure network login, document signing, and data encryption.

About HID Global

HID Global is the trusted source for secure identity solutions for millions of customers around the world. Recognized for robust quality, innovative designs and industry leadership, HID Global is the supplier of choice for OEMs, system integrators, and application developers serving a variety of markets. These markets include physical and logical access control, including strong authentication and credential management; card printing and personalization; highly secure government ID; and identification technologies used in animal ID and industry and logistics applications. The company's primary brands include HID®, ActivIdentity™, FARGO®, and LaserCard®. Headquartered in Irvine, California, HID Global has over 2,100 employees worldwide and operates international offices that support more than 100 countries. HID Global is an ASSA ABLOY Group brand. For more information, visit http://www.hidglobal.com/.

ActivIdentity, Genuine HID, the HID logo, HID on the Desktop, naviGO and OMNIKEY are trademarks or registered trademarks of HID Global in the United States and / or other countries / regions. All other trademarks, service marks and product or service names are the trademarks or registered trademarks of their respective owners.

Original Appearance: http://www.businesswire.com/news/home/20110214005457/en/HID-Desktop-Solution-Secure-PC-Logon-Receives

Read More >>

 Feds Set Deadline for Identity Smart Card Program

Original Appearance:http://www.securityinfowatch.com/Access+Control/1319556?pageNum=1

Federal agencies have until March 31 to come up with an implementation plan for a new government-wide identification system that leverages biometric technology and smart cards.

The federal government has stepped up plans to use the Federal Personal Identity Verification (PIV) system to verify employee and contractor credentials to access federal facilities and IT networks and systems, according to a memo from the Department of Homeland Security (DHS) issued Thursday.

The move to the system is mandated by Homeland Security Presidential Directive 12 (HSPD 12), a federal cybersecurity initiative the government said is aimed at increasing security and efficiency, reducing identity fraud, cutting costs and protecting personal privacy. Cybersecurity is a chief concern of the federal government, and the system is one of many it's taking to provide more security both internally and externally.

To qualify for PIV credentials, federal employees must have their fingerprints scanned and undergo background checks. Their personal identifying information is contained in cards that are scanned on card readers before entering federal facilities or logging on to federal IT networks. As of December 2010, 4.5 million federal employees had achieved PIV credentials, and 5 million of 5.7 million federal employees and contractors have completed background investigations, according to the memo.

In addition to outlining a time frame, the memo also lays out requirements for how agencies must ensure their facilities and IT systems are ready to accept the PIV cards.

The DHS mandates that all new systems under development must support PIV credentials according to guidelines from the National Institute of Technology (NIST) before they can be deployed.

Further, effective in October at the beginning of the government's 2012 fiscal year, agencies must upgrade all existing "physical and logical" access control systems to support the PIV system before they can use any technology refresh funds for other projects.

The DHS also is requiring that any procurements involving facility or IT system access meet HSPD-12 policy. PIV credentials and acceptance of the credentials also must be interoperable, according to the memo.

The memo directs each agency to pick a lead official to oversee their implementation plan.

Read More >>

What security technology will be hot at RSA 2011?

The annual RSA Conference, now in its 20th year, will be rocking next week as the security industry gathers in the weeklong extravaganza of product introductions and security experts arguing cloud and mobile computing security issues.

The annual RSA Conference, now in its 20th year, will be rocking this month as the security industry gathers in the weeklong extravaganza of product introductions and security experts arguing cloud and mobile computing security issues.

Read More >>

Moving Authentication to the Infrastructure

Original Appearance:http://www.scmagazineus.com/moving-authentication-to-the-infrastructure/article/194647/

Written By: Peter Stephenson

It would be nice – and convenient – if we could standardize all of the authentication methods for our enterprise on a single product or, at least, product type. But the fact is that we cannot. For example, a bank might have very strong authentication for system administrators, another type of strong authentication for senior managers, ID and password for most other employees, and some form of simple, but strong, authentication for customers of the online banking system. That is at least four different types of authentication. Add some layered methods – such as strong authentication for the database administrators and passwords to the applications for the same administrators – and the authentication scheme starts to get a bit complicated.

The thrust of ActivIdentity 4TRESS is to allow a diverse array of authentication methods – as well as provide a policy-driven tool for managing authentication – all in a single appliance. The management piece is very nice. The policy approach allows administrators to manage user profiles down to a fine granularity, and those policies are consistent across multiple service channels and lines of business or user communities. Thus, the authentication process becomes part of the enterprise's infrastructure rather than part of an application.

The secret is that 4TRESS abstracts away from the application and deals only at the user level. That means that no matter what the app requires, if a user is authorized on it, the authentication requirements are tied to that user.
 

Another benefit of the 4TRESS appliance is simplicity of deployment. A typical deployment consists of appliances with load balancing across a cluster of applications. Users can be associated with their authorized applications through an application programming interface (API) or through standard mechanisms, such as RADIUS. Since the 4TRESS appliance can connect to multiple user repositories – Active Directory, among others – this tool is ideal for bringing diverse environments together.

Setting up users is simple. User profiles contain all credentials and rights associated with those credentials. Virtually any type of authentication is accepted, including static passwords, smart cards, USB tokens, one-time passwords, certificates, out-of-band transaction verification and transaction signing. Of course, any particular user can have multiple methods and password policies associated.

4TRESS is reasonably priced, especially considering what it does and the environment – banking – in which it does it. The website is plain and simple to navigate with quite a few resources – from managed services, such as consulting information, to application notes, case studies and white papers.

There are two available support options. The standard option includes eight-hours-a-day/five-days-a-week support and free upgrades. The premium option expands support availability to 24/7, again with free upgrades.

Overall, this is a very good product – one that is somewhat unique in its capabilities, especially in the nuances of how it executes those capabilities. The tool is well thought-out, and the requirement it addresses is real. I liked it and, really, could find no fault with it. As with all systems that interact with users and the enterprise, though, one needs to understand one's goals in deploying it thoroughly. That said, there is no question that the ActivIdentity 4TRESS Authentication Appliance for Banking paradigm is to bring the functionality of authentication management solidly inside the enterprise infrastructure, rather than thinking of it as a standalone security application.

Read More >>

Axway is First Software Solutions Vendor Accepted as a Global Member of GS1 Healthcare Group 

PHOENIX--(BUSINESS WIRE)--Jan 31, 2011 - Axway, the Business Interaction Networks company, has become the first software solutions vendor accepted as a global member of GS1's Healthcare Work Group. GS1 is a non-profit global standards organization focused on improving the efficiency and visibility of supply and demand chains globally and across sectors. The expansion of Axway's membership will allow the company to drive standardization initiatives and improve patient safety on a global level.

According to the World Health Organization (WHO), counterfeit drug sales were estimated to reach $75 billion by the end of 2010, and research suggests that, in the U.S. alone, over 36 million civilians will have bought medicines from unlicensed web pharmacies. Becoming a global healthcare member will enable Axway to help address these issues by working alongside GS1 to raise the bar on patient safety and supply chain efficiency.

“Extending our U.S. membership to a global level with GS1 Healthcare is something we have wanted to do for some time. Previously software vendors could only apply for national membership in GS1 working groups. When GS1 opened the door to global membership, we embraced the opportunity to start to set the agenda and improve patient safety on an international scale. Axway has invested a lot of time in standardization efforts, underscoring our deep commitment to international standards,” said Dave Bennett, CTO of Axway.

J. Michael Wallace, director, global standards & serialization, Abbott and tri-chair, GS1 Leadership Team elaborated, “We are at the point where we have started the process of moving the GS1 Healthcare standards from development to implementation to meet various requirements, traceability in particular. During this process, it is critical that we have the active participation and leadership of solution providers who can bring their systems integration experience to bear. The GS1 Healthcare Leadership Team is excited to have Axway as our first solution provider partner for Healthcare. The traceability experience they bring to the GS1 Healthcare effort will be extremely valuable as we move our focus towards implementation.”

GS1 has member organizations in over 100 countries and leads the field in working with concerned industry parties (such as manufacturers, distributors, retailers, customs organizations, software developers, local and international regulatory authorities) to drive the design and implementation of the most widely used standards system in the world across all sectors and industries.

GS1 standards enable health and economic benefits related to automatic identification, traceability, data synchronization and effective and efficient roll-out of automatic identification and traceability systems throughout the healthcare sector. This approach to defining global standards complements Axway's commitment to preventing counterfeiting and fraud within the healthcare industry.

Axway solutions widely support GS1 standards. Axway Track & Trace, the solution for visibility, efficiency and security in global supply chains, supports the GS1 Electronic Product Code Information Services (EPCIS) standard. Axway B2Bi, the integration solution for electronic business messaging and data synchronization, supports message formats and protocols defined in GS1 eCom and Global Data Synchronization Network (GDSN) standards.

The expanded membership will enable Axway to contribute to standards implementation on an international scale through its business, functional and technical expertise in building solutions for business interaction networks. This will drive best practices in tackling the main risks to patient safety across the industry, while remaining compliant with various regulations in different markets. Specifically, Axway's participation in the GS1 Healthcare Global Public Policy Work Group will contribute to compliance with future European directives.

Ulrike Kreysa, director, GS1 Healthcare says: “As a truly global company, Axway is a valuable member of the Healthcare working group, bringing software expertise together with a sound knowledge of global practice and regulatory environments. I am sure that Axway will continue to demonstrate its value and will be a fantastic part of the group. I am hopeful that other solutions vendors will follow the example that Axway has set forth.”

“Ensuring that our software is fully integrated and interoperable according to international standards is exceptionally important to us and our customers,” adds Bennett. “By expanding our relationship with GS1, we will be able to do even more to help ensure that our customers, and ultimately patients, get the best and most reliable service possible.”

View the Axway video blog post: GS1, Healthcare, and Axway

Follow Axway on Twitter: http://twitter.com/Axway

About Axway

Axway is the Business Interaction Networks company - the only provider in the market today to manage, run, secure, and monitor all of your business interactions, including email, files, messaging, services, events, and processes. Serving over 11,000 organizations in more than 100 countries, Axway facilitates the multi-enterprise transactions, processes and integration that accelerate business by eliminating the barriers between vendors, customers, departments, partners and suppliers. Axway's comprehensive offerings include business-to-business integration, managed file transfer, secure email, business activity monitoring, enterprise application integration, service-oriented architecture, business process management, track & trace and identity validation solutions. Axway provides professional and managed services, as well as cloud computing and Software-as-a-Service (SaaS) offerings. Headquartered in Phoenix, Arizona, Axway's global presence spans 20 countries.

About GS1and GS1 Healthcare

GS1 is a neutral, not-for-profit organization dedicated to the design and implementation of global standards and solutions to improve the efficiency and visibility in supply chains. GS1 is driven by more than a million companies, who execute more than six billion transactions a day with the GS1 System of Standards. GS1 is truly global, with Member Organisations in over 100 countries, with the Global Office in Brussels, Belgium.

GS1 Healthcare is a global, voluntary Healthcare user group developing global standards for the Healthcare supply chain and advancing global harmonization.

For more information visit: www.gs1.org/healthcare

About Abbott

Abbott (NYSE: ABT) is a global, broad-based health care company devoted to the discovery, development, manufacture and marketing of pharmaceuticals and medical products, including nutritionals, devices and diagnostics. The company employs nearly 90,000 people and markets its products in more than 130 countries. 

Contact: SHIFT Communications
Jennifer Usher, 415-591-8456
axway@shiftcomm.com

Read More >>

The UCI Uses Cloud-Based File Exchange Solution from OpenTrust

PARIS--(EON: Enhanced Online News)--OpenTrust, the Next-Gen IT security software publisher, today announced that the International Cycling Union (UCI) is using OpenTrust MFT to exchange confidential documents with manufacturers as part of its new frame and fork certification process.

“OpenTrust MFT’s powerful administration tools make the solution ideal for managing both one-to-one and group document exchanges with manufacturers in complete security.”

Based in Aigle, Switzerland, the UCI develops and promotes cycling, enforcing disciplinary rules and overseeing international cycling events. On Jan 1^st 2011, the UCI published a new protocol for frame and fork testing in which OpenTrust Managed File Transfer (MFT) has been deployed as a trusted web-based service and is used to transmit documents securely over an encrypted network throughout the approval procedure.

The UCI began investigating possible file exchange solutions for the certification process at the end of 2010. The principal requirement was to ensure that all documents exchanged are done so in accordance with the UCI’s confidentiality policy related to plans, drawings, designs, brands, models or any other intellectual property submitted by manufacturers.

With its built-in reporting and auditing capabilities, OpenTrust MFT ensures compliance with all the UCI’s requirements for traceability of actions and exchanges. The solution guarantees secure reception of all files with proof of sending and can be used to exchange files of all types and sizes. In addition to providing a high level of confidentiality, OpenTrust MFT is simple to use for the manufacturers. The intuitive Web-based interface can be accessed from any location using a standard browser.

“OpenTrust MFT’s powerful administration tools make the solution ideal for managing both one-to-one and group document exchanges with manufacturers in complete security.” said Hervé Lecart, Associate Director Online Services at OpenTrust. “We are very proud to count the UCI as one of our many global customers that have successfully deployed our cloud-based services.” continued Mr Lecart.

Original Appearance: http://eon.businesswire.com/news/eon/20110111006120/en/UCI-Cloud-Based-File-Exchange-Solution-OpenTrust

Read More >>

VeriFone and Gemalto Team to Sell EMV Chips in the States

Written by: John Adams

The reluctance of the U.S. payments market to adopt the EMV chip and PIN payments standards has been under a lot of pressure, given the security-threatening isolation this avoidance may bring about. As a result, EMV-type chips are percolating domestically, such as VeriFone and Gemalto’s planned push of solutions.

The two firms will jointly offer EMV-compliant point of sale card technology to banks, retailers and card networks. While EMV standards has been widely adopted in Europe, adoption has lagged in the U.S. over concerns about the cost of retrofitting payments systems and processing.

That reluctance has already caused problems for U.S. travelers whose mag stripe cards are denied overseas, and large retailers such as Wal-Mart have called for EMV to be adopted in the U.S.  Other firms, such as Travelex, are offering hybrid mag stripe/chip and PIN cards for travelers.   

VeriFone and Gemalto’s partnership includes the development of EMV chip cards, as well as the transfer of Gemalto’s POS solutions to VeriFone and Gemalto becoming the preferred supplier of Machine to Machine wireless products for VeriFone’s payment systems.

VeriFone has also upped its presence in the PCI compliance game, recently partnering with RSA to market point to point encryption and tokenization as an integrated payment security offering.

Original appearance:http://www.rfid-tech.net/the-future-of-the-identification-process/ 

Read More >>

Thales nShield Connect to Protect Security of Internet

Thales, leader in information systems and communications security, announces that RIPE NCC, a Regional Internet Registry (RIR) for Internet number resources, is introducing a new process that leverages Thales nShield Connect hardware security modules (HSMs) for validation of  Internet resource-related messages. The digital certificate-based process will allow Internet Service Providers (ISPs) and telecommunications companies to automatically authenticate the legitimacy of the source of Internet traffic. The new process is expected to make the routing of Internet traffic more secure, reliable, and efficient. 

An independent, not-for-profit organization, RIPE NCC is one of five Regional Internet Registries (RIRs) that provide Internet resource allocations, registration services, and coordination activities that support the operation of the Internet globally. RIPE NCC facilitates the allocation and registration of IP address for the reliable routing of Internet traffic. The organization maintains a database of registered resources for all RIPE NCC members, most of whom are telecommunications companies, ISPs, and large corporations. Internet number resources make it possible to find websites and communicate online. Resource holders can send messages to other entities about their resources. These messages might indicate a number change or specify how traffic should be routed to reach the resources controlled by their numbers. These resources are often websites.

Read More >>

Wikileaks Fallout: Military bans thumb drives

By Athima Chansanchai

Fallout from the latest WikiLeaks releases continues, as the military has issued a "Cyber Control Order" to troops to immediately stop use of removable media such as thumb drives, CD's, DVD's and other portable and removable media that could be used to transfer sensitive information. The penalty for violating the order: court martial.

Wired's Danger Room obtained the Dec. 3 order, which came from Maj. Gen. Richard Webber (no, not from "Grey's Anatomy"!), and directs those under his command at Air Force Network Operations to "immediately cease use of removable media on all systems, servers, and stand alone machines residing on SIPRNET," or Secret Internet Protocol Router Network, the Defense Department’s secret network. Wired reports "similar directives have gone out to the military’s other branches."

Read More>>

Read More >>

World Smart Card Market Worth US $6.6 Billion By 2015

Source: MarketsandMarkets

According to a new market research report, ‘World smart card- advanced technologies, application and global forecast (2008 – 2015)’, published by MarketsandMarkets (www.marketsandmarkets.com), the total world smart card market is expected to be worth US$6.6 billion by 2015, out of which the Telecommunication sector will account for nearly 53.8% of the total revenues. The global market is expected to record a CAGR of 7.3% from 2009 to 2014.

Browse 35 market data tables and in-depth TOC on Mobile applications Market. 
Early buyers will receive 10% customization of reports

http://www.marketsandmarkets.com/Market-Reports/smart-card-285.html

Growing mobile penetration, surge in acceptance from various governments and increased security and reliability has spurred the growth of smart card shipments, which reached 5.2 billion in 2009. Advent of new form factors such as Near Field Communications (NFC) and Machine-to-Machine (M2M) communication, growing government ID projects across the globe and EMV compliance will support the growth of smart cards for next five years, resulting into 8.8 billion smart cards shipment by the end of 2015.

The smart card market revenue is expected to grow from $4,498.9 million in 2009 to reach $6,600 million in 2015 with a CAGR of 7.3% from 2010 to 2015. EMEA region holds the maximum share of revenue in consumer electronics market on account of technological competence, high adoption of high end smart cards and growing need of secure transaction and identity and access control. The Asian region, especially, India and China have emerged as smart card hotspots with continuous development of the cellular markets and the increasing 3G penetration and increased governmental interest across the region.

The smart card technology is a major driving force for the payment transaction market as it allows customers to make secure payments. Thus, it is expected that microprocessor based smart cards will continue to dominate the smart card shipments, as compared to the memory chip based smart cards. The microprocessor segment has accounted for shipments of 4.5 billion smart cards in 2009, which was 86.5% of the overall shipments (5.2 billion) of smart cards. The report provides extensive analysis of the smart card industry, current market trends, industry drivers and challenges for better understanding of the smart card market structure..

Scope of the report

This research report categorizes the global smart cards market for forecasting the revenues and analyzing trends in each of the following submarkets:
On the basis of smart card interface:

·              o                          Contact smart card

o                          Contactless smart card

o                          Hybrid and Dual interface smart card

On the basis of components

·             o                          Microprocessor

o                          Memory smart cards

On the basis of smart card application in various sectors:

·             o                          Telecommunications sector

o                          Government IDs and healthcare sector

o                          Financial services, retail and loyalty sector

o                          Pay TV sector

o                          Transportation sector

o                          Others

In addition to market sizes and forecasts, the report also provides a detailed analysis of the market trends and factors influencing market growth, offering in-depth geographic analyses of the smart card market in the North America, EMEA, Asia-Pacific, and South America. The report draws the competitive landscape of the global smart card market, providing an in-depth comparative analysis of the technological and marketing strategies the key players are adopting in order to gain an edge over the their competitors.

http://www.environmental-expert.com/resultEachPressRelease.aspx?cid=40067&codi=207568

Read More >>

ActivIdentity to be Acquired by ASSA ABLOY, Parent Company of HID Global

Original Appearance: Actividentity Website

ActivIdentity to join the HID Global business unit, advancing the convergence of logical and physical access systems

Fremont, Ca., Oct 11, 2010 - ActivIdentity Corporation, (NASDAQ: ACTI), a global leader in intelligent identity assurance, today announced that the company has entered into a definitive agreement to be acquired by ASSA ABLOY AB, the parent company of HID Global, in a cash transaction at a price of $3.25 per share, or approximately $162 million. This per share price represents a premium of approximately 43% over the closing price of ActivIdentity shares on Friday, October 8, 2010 and a premium of 48% over the 20-day average of closing prices. ActivIdentity will become part of ASSA ABLOY’s HID Global business and ActivIdentity products will provide the foundation for HID Global’s logical access offering.

The acquisition, which is subject to ActivIdentity shareholder approval, applicable regulatory clearances and other customary closing conditions, is expected to close in December 2010.

Commercial and government organizations are faced with ever-changing threats to their information and physical assets and, at the same time, they must deal with a broad range of compliance requirements. Optimizing security while simplifying the user experience and minimizing costs is a enormous challenge that can best be solved by joining logical and physical access capabilities into a single, integrated solution. The combination of ActivIdentity’s suite of identity assurance solutions with HID’s physical and logical access solutions, provides a powerful offering to the market.

“Organizations and their users are burdened with the expense and complexity of redundant identity assurance technologies,” said Grant Evans, chairman and CEO of ActivIdentity. “Now for the first time, customers will be able to benefit from the convergence of physical and logical access control solutions.”

“Through the combined power of HID Global and ActivIdentity, we have a compelling opportunity to finally address the use of a single credential for access to physical and logical domains,” said Denis Hebert, president and CEO of HID Global. “ActivIdentity is a strong complement to our identity and access management solutions, enabling us to add a new dimension in our ability to deliver value to our customers.”

Foros Securities LLC acted as exclusive financial adviser to ActivIdentity. Wilson Sonsini Goodrich & Rosati, P.C. acted as counsel to ActivIdentity

NFC-enabled BlackBerry smartphones will "open doors" with HID Global’s iCLASS® digital keys and readers

The new BlackBerry® Bold™ 9900/9930 and BlackBerry® Curve™ 9350/9360 smartphones activated with iCLASS digital credentials will be compatible with the large installed base of iCLASS readers that are used for applications ranging from physical access systems in buildings, to student IDs, to applications that track time and attendance.

Instead of using keys or smartcards, BlackBerry smartphone users will be able to use iCLASS digital credentials that can be presented for authentication by simply holding their NFC-enabled BlackBerry smartphone in front of a reader, just like they do today with a physical iCLASS smartcard.

Pilots using BlackBerry smartphones activated with iCLASS digital credentials will be conducted this year. HID Global expects that its embedded iCLASS technology will be generally available for the BlackBerry Bold 9900/9930 and BlackBerry Curve 9350/9360 smartphones in early 2012.

Original Appearance:http://www.sourcesecurity.com/new-products/listing/1/product-profile/access-control/readers-and-controllers/readers/hid-rk40.html

SafeNet provides security guidelines for PKI-based transactions

In light of recent security breaches that have attacked enterprises’ PKI infrastructure, Baltimore-based data protection provider SafeNet released security guidelines to enhance PKI-based transaction security.

SafeNet’s cryptographic experts first advise that companies consider securing their private keys in a hardware-based security module (HSM). While software-based security has the benefits of portability and flexibility, it’s also vulnerable to being copied and living in multiple locations simultaneously. The HSM can create a trust anchor to lock keys and grant access to key information from an authorized source.

Original appearance: http://www.digitalidnews.com/2011/09/23/safenet-provides-security-guidelines-for-pki-based-transactions

 Demystify PKI

Public Key Infrastructure (PKI), in the early days of the Internet, was touted as the most secure way to authenticate users, devices, and documents. IT decision makers began to investigate, and many articles were written then, quite suddenly, there was a large media backlash against PKI. 

Julian Lovelock, Senior Director, ActivIdentity (part of HID Global) explains: “It was a sledge hammer used to kill a fly. It was arbitrarily complex and required labour-intensive key ceremonies with other organisations to deliver some features such as encrypted or digitally-signed email. It was overly complex for mere mortal IT professionals, and surely there were simpler methods of authentication such as OTP that enterprises could use. PKI became almost an IT bogeyman!” stated Julian Lovelock.

“But then a funny thing happened. First, PKI was adopted by governments and powerful credential management software (CMS) was created to automate much of the credential issuance, update and revocation process,”

“Ecosystem vendors such as Microsoft, Juniper, and Cisco built PKI support into their offerings. CMS software eventually made its way into appliances that could provide a much simpler “sweet spot” PKI solution for “closed-loop” PKI (Issuer and Authenticator are part of the same organisation hence greatly reducing the number of parts in the system),” continued Julian.

“Secondly, security threats began to attack aspects of the most common OTP (e.g., the recent breaches against security vendors and government agencies), causing enterprises to wonder what better authentication methods are out there.”

Today, PKI is getting a second look. Many people still have a knee-jerk suspicion that PKI was designed to make them feel stupid, but modern closed-loop PKI managed by an appliance does just the opposite. New CMS appliances make it so IT doesn’t even have to understand PKI to deploy a military-grade smart card solution.

Julian Lovelock continued: “In retrospect, as an Internet Meme, PKI suffered from hype before the tools were in place to manage it, and from security experts getting over excited and describing the ultimate PKI solution possible, even though few Enterprise users needed some of the more esoteric, complex and labour-intensive features. When PKI vendors got carried away educating users about every possible use case, they turned potential users off of the most high-value, low-cost use cases,”

"If I were to tell you I could give you a device that you just plugged into your PC, it worked like an ATM card and gave you secure access to PCs, networks, cloud applications, and VPNs, you would probably think, "Hey that sounds easier for users than clunky OTP tokens, how do I get that?" This is not your father's PKI!" concluded Julian.

Secure the Enterprise

Jerome Becquart of ActivIdentity, part of HID Global discusses the challenges facing CSOs in Securing the Enterprise, and how a multilevel security approach can help safeguard the enterprise and minimize the risk of potential security breaches.

What have recent headlines taught us about enterprise security breaches, and how can enterprises increase security?

The perception that organizations are untouchable and security cannot be breached is something of the past. In the first five months of 2011, we saw 178 million to 218 million user accounts, e-mail addresses, token seed files or records stolen from companies that were breached. In the wake of recent high-level security breaches, CSOs must be ready to answer the tough questions CEOs are asking about their organizations' security prepardenss.

As threats become more sophisticated and frequent, security measures such as perimeter defense and traditional OTP no longer offer suffi cient protection. By implementing a multi-layered approach with a combination of smartcards and advanced OTP tokens, the security organization can validate and authenticate users’ access to resources, providing a trusted envirnoment for users.

Why are enterprises more vulnerable today? Where are these vulnerabilities?

Traditional security methods such as static passwords and authentication at the perimeter are almost obsolete for protecting employee credentials and enterprise data. Restricting employee Internet access has proven impractical, because it interferes with daily business operations. As the value of customer assets increases, so does the value of getting into these assets. Hackers are using social networks to breach the system, assuming employee identities. Once they have penetrated the IT network, hackers can easily access sensitive IT resources and valuable corporate information.

How can companies have a security solution that addresses the global scope, frequency and sophistication of today’s threats?

They must create an environment in which employees can establish trust in the identity of anyone accessing resources, particularly sensitive information. CSOs need to feel confident about the steps they have taken to protect the network and resources. They also need to implement an enterprise identity assurance solution that validates users’ identities, authenticates their credentials and provides access based on these credenitals. Enterprises need to make sure the security environment does not have an impact on daily business activities and that they educate employees and keep them informed.

Some organizations are implementing perimeter defense systems and smart tokens. Does this strategy address advanced persistent threats?

Yes, multi-layered strong authentication inhibits an attacker’s ability to escalate account privileges or leap laterally to compromise other users’ accounts. Using smart card to secure VPN, Windows login and server access can signifi cantly reduce the risk of breaches. Employing OTP tokens with algorithms based on multiple varaibles is also a good strategy.

As a part of HID Global, how can ActivIdentity help enterprises strengthen their security strategy into the future?

I believe that as part of HID Global our identity assurance solutions will be able to meet the customer needs of today and the future. Identity assurance solutions must be adaptable and scalable to meet the needs of the enterprise at all levels, and I believe we can provide customers with this solution. I foresee in the near future that a CSO priority will be convergence—the use of a single credential to authenticate to a PC, network, applications, digitally sign emails, encrypt data and open a facility door. 

For more information, please download the white paper, "Deploying Strong Authentication: The Threats Are Changing . . . Are You?" here.

Are OTP Tokens Secure?

There’s a lot of chatter at the moment, for understandable reasons, about whether OTP tokens can still be considered secure. But according to Julian Lovelock, Senior Director, ActivIdentity, a global leader in secure identity solutions, recently acquired by HID Global, there’s no black and white answer.

Julian Lovelock stated: “Much of the concern around the security of OTP tokens stems from their underlying reliance on a symmetric key model. What that means in practical terms is that you need to load into the authentication server an exact copy of the key that’s injected into the OTP token. These keys, often referred to as ‘seeds’, therefore need to be managed. And the processes and systems that manage those keys/seeds are great places for attackers to go after.”

“When determining whether OTP tokens are secure enough, enterprises should take a look at how the keys are being managed. In many cases the process is as follows. The token vendor injects a key into the token during manufacturing. In parallel a seed file is created containing all the keys for a batch of tokens. The tokens are shipped to the customer along with the seed file. An administrator at the customer site loads the seed file into the authentication server,” he continued.

According to Julian Lovelock there are actually six potential points of compromise in the chain:

1. The manufacturing process that generates the seed file

2. The transport of that seed file to the customer site

3. The management of that seed file on site, prior to being loaded into the authentication server

4. The secure storage of the seed file within the authentication server

5. The retention by the customer of that seed file (often on a CD) subsequent to its being loaded into the authentication server

6. The retention of that seed file by the OTP token vendor

Julian Lovelock continued: “A far more secure model is one in which customers can initialise OTP tokens themselves from the admin console of the authentication server. In this model those pesky seed files are removed from the process because the key is simultaneously injected into the token and authentication server database. This eliminates five of the six potential points of compromise that attackers can go after,”

“Going forward RSA will no doubt take extraordinary steps to ensure that seed files can’t be stolen from their internal systems. But, if you have six unlocked doors in your house, then just locking the one the burglars came through last time doesn’t necessarily make for a secure home. Of course there is a way to avoid all six points of compromise, which is to deploy smart cards, since these rely on an asymmetric key model,” concluded Julian Lovelock.

Cyber Security Investments are Cost Effective says New York State Comptroller

NEW YORK - State Comptroller Thomas DiNapoli reminded local governments and school districts that they can save money and trouble by investing in cyber security. DiNapoli released a report on Information Technology (IT) security that detailed local government security breaches and identified preventive measures. 

“IT security breaches cause a lot of damage,” DiNapoli said.  “And taxpayers end up footing the bill to repair that damage.  It’s a lot cheaper to prevent a breach than it is to repair one after it happens.  Despite tight budgets, local governments and school districts should be investing in cyber security; it’s an investment that will pay off. ”

Recent studies have found that security breaches are up 48 percent since 2010, with 16 percent affecting government entities. A breach costs the public sector an estimated $81 per record and potential financial impacts range from $2.8 million for small counties to $67 million for the state’s largest counties. Several cyber breaks have already affected New York’s towns and school districts.  

DiNapoli’s report highlighted several examples of local government IT security breaches.  In the Duanesburg School District, hackers transferred $3 million in funds overseas. Illegal software on the town of LeRoy’s computers was traced to a 14-year-old intruder using the network for illegal Internet games and cost $80,000 to remedy.  And a 16-year-old Shenendehowa High School student was charged with identity theft after he hacked into the school’s computer system.

In his Snapshot report, DiNapoli noted that even in tough fiscal times, local governments and school districts can take simple steps to reduce their chances of being targeted by hackers, such as:

•  Regularly tracking IT activity, including all remote access activity. 
•  Limiting, restricting and periodically updating access rights. 
•  Developing and testing disaster recovery plans. 

Aberdeen Group Projects Increased Demand for Smart Cards to Continue

FREMONT, CA--(Marketwire - Jul 20, 2011) - ActivIdentity Corporation, a global leader in secure identity solutions, part of HID Global, today announced that Aberdeen Group, a Harte-Hanks Company, has published a new market alert titled "The Case for Smart Cards." The study commissioned by ActivIdentity explored the RSA SecurID breach and subsequent industry shift toward smart cards. The resulting paper identifies the breach as the primary market driver for this trend along with the erosion of traditional network perimeters, the weakness of traditional username and password authentication methods, and the potential compromise of privileged systems and accounts.

According to two recent Aberdeen research studies -- "The Zen of Network Access" (December 2010) and the "Q1 2011 Aberdeen Business Review" (May 2011) -- there was a noticeable shift in market trends in the area of end-user authentication, showing a decreased use of OTP by a factor of 2.5- to 3-times, whereas the demand for smart cards increased by a factor of 1.5- to 2-times. As noted in the "The Case for Smart Cards" paper, the multi-factor authentication provided by smart cards makes elevation of access privileges (as seen in the RSA attack) considerably harder, and also inhibits untrustworthy insiders.

"The Case for Smart Cards" is available for free download on the ActivIdentity website:http://www.actividentity.com/resources/whitepapers/download/?PWID=18. It outlines the following key factors and benefits that are driving the smart card market opportunity:

• • The multi-purpose nature of smart-cards.
• • Advancement in credential management systems that support the management of smart cards and card-based credential throughout their lifecycle.
• • Greater vendor-integration and out-of-the-box support for essential capabilities, such as certificate authorities, hardware security modules and integration of card-based authentication with applications, networks, endpoints, servers, physical access management systems, etc.
• • Greater flexibility and choice in terms of deployment models.
•  

"Recent technological improvements make smart cards more accessible to a broader market, especially small and medium-sized organizations," said Derek Brink, vice president and research fellow for IT Security at Aberdeen Group. "The RSA breach and other related news headlines are raising industry awareness of the risks associated with failure to use the most up to date two-factor authentication methods at the very least."

"The study makes it clear that the old, perimeter-based defense model that has been used for decades, is no longer effective by itself," said Julian Lovelock, ActivIdentity's senior director of product marketing. "Use at work of personal mobile devices, sophisticated malware and popularity of social networks are making it increasingly difficult to keep the perimeter secure. Companies are realizing that they need to implement strong authentication to secure access, even for users on the internal network."

By Neville Pattinson, Vice President for Government Affairs, Standards and Business Development at Gemalto

It is safe to say that Americans live in a cyber world. With more than 91% of Americans using mobile phones, many of them smart phones, the desire to stay connected has turned into a necessity and is now expected.

Health records, location-based services and mobile payments are trends on the rise all with one common denominator: your identity. In today’s advanced world of technology, the importance of protecting personal identity is crucial now more than ever. Information including account passwords, credit card details, cell phone contacts and emails are all under the same house when your life goes digital.

One of the most important security issues at hand is the need for higher security and protection of identification credentials along with the ability to establish trust in cyberspace.

Original Appearance:  http://www.governmentidnews.com/2011/01/05/evolution-of-the-identity-credential

Anonymous hacks Booz Allen Hamilton to leak info on 90K

written by: Angela Moscaritolo

The hacktivist group Anonymous on Monday released the email addresses and encrypted passwords of some 90,000 military users, all siphoned from a vulnerable server at government consulting firm Booz Allen Hamilton.

The hacking collective said the server "basically had no security measures in place,” according to a statement posted on file-sharing site The Pirate Bay.

The leak included the login credentials of personnel from the U.S. Central Command, the Marine Corps, Air Force, State Department and private sector contactors, according to a report from technology weblog Gizmodo. The military passwords were encrypted using the oft-criticized MD5 hash algorithm, Anonymous said in its statement.

The data dump also includes a variety of information related to government agencies, federal contractors and “shady white hat companies,” Anonymous said. In addition, the hacking group claimed to have deleted four gigabits of the consulting firm's source code which it deemed “insignificant.”

Booz Allen Hamilton, which offers a host of cybersecurity solutions, declined comment.

"As part of [our] security policy, we generally do not comment on specific threats or actions taken against our systems," Booz Allen wrote in a tweet.

The leak was part of a recently announced venture dubbed Anti-Security, or AntiSec, which calls for hackers worldwide to expose sensitive data that reveals wrongdoing within governments and corporations.

In its statement, Anonymous accused Booz Allen Hamilton of “shady” business practices, including “potentially illegal surveillance systems, corruption between company and government officials, warrantless wiretapping, and several other questionable surveillance projects.”

“All of this is, of course, taking place behind closed doors, free from any pubic knowledge or scrutiny,” the hacktivists said.

Anonymous has previously taken credit for attacks against anti-WikiLeaks websites and the security firm HB Gary Federal.

Health care providers seek convergence

As more health care providers begin the move to electronic medical records, efforts are underway to better secure the computers and networks that store the data.

The U.S. government’s Health Information Technology for Economic and Clinical Health (HITECH) Act and it’s $19 billion for providers has been the driver for many to move to electronic records.

The legislation also calls for health care organization to have “meaningful use” of the software in order to qualify for the grants. “The criteria requires health care data to be kept confidential, private and secure, accurate, shareable with patients as well as providers, mobile and exchangeable, and readily available,” states a Smart Card Alliance white paper that was released in February.

REDWOOD CITY, Calif.--(BUSINESS WIRE)--As data protection mandates become stricter and high profile instances of data loss proliferate in the media, a new survey of more than 360 attendees at Infosecurity Europe 2011 found that two thirds of respondents (67 percent) hold disk encryption to be an IT security priority. The study was conducted by authentication and endpoint security provider DigitalPersona, Inc.

“Security-conscious organizations are increasingly recognizing that traditional authentication factors are simply not secure enough to protect against today’s threats”

“In recent months we have witnessed a steady stream of high profile hacks at large organizations where sensitive data has been compromised. Businesses are seeing these attacks, as well as the major financial and reputational damage that they cause, and are realizing the importance of protecting their own data wherever it resides,” said Jim Fulton, vice president of marketing at DigitalPersona.

“Although it’s encouraging that most businesses are making encryption a priority, it’s vital that they understand how to implement it effectively,” continued Fulton. “Given the proliferation of devices these days, with notebooks outselling desktop computers, it’s pointless only to encrypt centrally-held data. It’s simply not enough to protect sensitive and confidential information in one place if you’re going to ignore all the copies and pieces of data that are replicated on devices across the business. While large enterprises may have the resources to implement effective and comprehensive disk encryption on all devices, smaller organizations have traditionally reported difficulty finding encryption that is affordable and easy to implement.”

The survey also found that more than two in five respondents (42 percent) were interested in biometrics for network access control.

“Security-conscious organizations are increasingly recognizing that traditional authentication factors are simply not secure enough to protect against today’s threats,” said Fulton. “Biometric technology has really matured in the last couple of years, to the extent that it is an affordable, reliable and efficient means of ensuring that only legitimate users can access networks, devices or data. No longer prohibitively expensive, biometrics now enable small and medium-sized businesses to implement robust, enterprise-grade authentication, without the complexity and inconvenience of token-based systems—a fact recognized by almost half of our respondents.”

Latest market updates are available from DigitalPersona on Twitter.

About DigitalPersona

DigitalPersona, Inc. is a global provider of authentication and endpoint protection solutions that make security simple, practical and affordable for businesses of all sizes. The company helps enterprises, government agencies, custom application developers and independent software vendors close the gap between people and security to efficiently address growing compliance and fraud-prevention demands. DigitalPersona’s award-winning technology is offered by market-leading computer manufacturers and solution providers around the world. For more information contact DigitalPersona, Inc. at: +1 650.474.4000, or visit www.digitalpersona.com.

© 2011 DigitalPersona, Inc. All rights reserved. DigitalPersona is trademarks of DigitalPersona, Inc. registered in the United States and other countries. All other trademarks are the property of their respective owners.

IMF latest victim of "major" cyberattack, breach

The fund, which oversees financial crises worldwide and maintains sensitive financial information about member countries, disclosed the incident to employees and its board of directors on Wednesday, according to a report in the New York Times, which first reported the news. The attack, which occurred over the last several months, led to a “very major breach,” according to the paper, citing an official familiar with the incident.

The IMF did not immediately respond when contacted by SCMagazineUS.com on Monday. The organization has not publicly disclosed the attack.

Many details about the incident, including to what information the attackers gained access, remain unknown. Based on the limited information that is currently available, the attack, which may have been state-sponsored, appears to have begun with a so-called spear phishingemail that introduced malware onto an IMF desktop. Attackers then used this entryway to access fund systems. 

In its internal memo to employees, the IMF reportedly said it had detected “suspicious file transfers.”

In light of the attack, the IMF also reportedly told staff it would be replacing their RSA SecurID tokens, which are used for authentication. The fund said it does not believe, however, that the attack was linked to the recentcyberattack against RSA that garnered intruders sensitive information about SecurID products. The stolen SecurID data was leveraged in an attack against defense contractor Lockheed Martin.

According to reports, unease over the IMF breach has caused the World Bank, which provides financial assistance to developing countries around the world, to disconnect a computer link that allows the two organizations to share information.

The fund joins several other major organizations that have suffered attacks in recent weeks, including Citibank, Lockheed Martin, FBI partnerInfraGard, Sony and Google.

“It seems a single day can't pass without a well-known institution making the headlines for being the victim of a hacking attack or loss of sensitive data,” Graham Cluley, senior technology consultant at anti-virus firm Sophos, wrote in a blog post Sunday. “All organizations need to take the seemingly growing tide of internet attacks as a warning sign, and ensure that they have strong defenses in place and that every member of staff has been trained in best practices to reduce the risk.”

Mobile wallet roll out starts with small change

(Reuters) - Virtual wallet technology that lets people pay for a coffee, newspaper or sandwich by swiping a cell phone at a checkout is finally set to start rolling out, executives told the Reuters Technology Summit this week in Paris.

Retailers, fast-food chains, advertisers and banks are preparing for a sea change in electronic commerce as more smartphones capable of making financial transactions are released. Many say it will change the way they do business.

Near-field-communication (NFC), the technology most likely to be used in the West, is a wireless way to swap data at short range, which means NFC-enabled smartphones can pay for goods, store electronic tickets, collect coupons or swap photos.

"2011 is likely the year when NFC could be on its way to become a mainstream technology in U.S. and Western Europe," said Andrew Gardiner, an analyst at Barclays Capital.

Richard Clemmer, chief executive of top NFC chipmaker NXP, said Google has given a great boost to adoption by including NFC capability in its Android software, which is used by smartphone makers the world over.

"We co-invented the NFC technology eight or nine years ago with Sony. We tried to push it but frankly we just didn't have the influence," he told the summit.

"What we did by aligning with Google allowed us really to have a much larger impact. We'd been working with credit card companies, and it kept being on the roadmap four quarters out."

On Friday, Orange and Barclaycard launched Britain's first mobile payments service, allowing certain customers to make small payments in branches of fast-food chains including McDonald's and Subway.

In other countries, notably Japan and South Korea, NFC technology is already well established.

"I was blown away in Japan by NFC payments in action and with the ease and convenience of payments," Timo Soininen, chief executive of Finnish Web games company Sulake, said when asked what was the coolest thing he had seen in technology this year.

"It will change everything."

Clemmer said every smartphone manufacturer was looking at putting NFC in its phones. He reckons up to three-quarters of all smartphones will be NFC phones in five years and that some traditional phones will also start adding the technology, particularly for use in developing markets in Africa and Asia.

Barclays Capital's Gardiner said: "NFC has the potential to evolve into a billion-dollar-plus semiconductor market over the next four to five years."

LOW RISK, SMALL CHANGE TO DRIVE FIRST WAVE

Low risk data transfers like using NFC to read tags on movie posters, connect to wifi at cafes and swap business cards will help boost acceptance and drive the first big wave of NFC rollout to the consumers.

The interaction of smart posters and coupons is projected to help drive the adoption of NFC with consumers, according to Don Tait from IMS Research in the UK.

IMS estimates that by 2015 there will be more than 900 million devices with NFC technology including cellphones but also in terminals, laptops, tablets, tags, tokens, posters, watches, headsets and ATMs.

The "physicalisation of social media" or swapping LinkedIn Profiles or Facebook pages, Foursquare checkins and sharing games on line, is expected to be one of the most popular uses, according to David Birch from Consult Hyperion.

Electronic payments will still be the key driving force in the widespread acceptance of NFC, but initially the financial amounts in question will remain limited.

The Barclays-Orange mobile service launched on Friday only allows transactions up to 15 pounds, ($24) at a time, since the initial scheme wants to try to replace the cash people fumble for when looking to pay for that first coffee or morning paper.

"Right now we are looking at areas around low value transactions, as we're trying to see what consumers want and how much they feel comfortable with, said James Rees from Orange, adding that eventually that sum would be raised.

Opera Software co-founder Jon von Tetzchner told the summit NFC in its current form was "cute" but that he's still waiting to be able to do "real commerce" from the mobile phone, at least as much as is now currently possible from a personal computer.

From initial NFC trials, consumers have found NFC-enabled phones intuitive and easy to use and finding it easy will help the technology to be adopted by wide sectors of the population.

Olivier Piou, chief executive of smartcard maker Gemalto speaking at the summit said NFC pilot projects Gemalto has been involved with have shown that consumers find it so easy, they welcome using the technology.

HHS inspector general says push for electronic medical records overlooks some security gaps

WASHINGTON — The nation’s push to computerize medical records has failed to fully address longstanding security gaps that expose patients’ most sensitive information to hackers and snoops, government investigators warn.

Two reports released Tuesday by the inspector general of the Health and Human Services Department find that the drive to connect hospitals and doctors so they can share patient data electronically is being layered on a system that already has glaring privacy problems. Connecting it up could open new pathways for hackers, investigators say.

The market for illicit health care information is booming. In recent years, the case of a former UCLA Medical Center worker who sold details from the files of actress Farah Fawcett, singer Britney Spears and others to the National Enquirer gained notoriety.

Most cases don’t involve celebrities or get much attention. Yet fraudsters covet health care records, since they contain identifiers such as names, birth dates and Social Security numbers that can be used to construct a false identity or send Medicare bogus bills.

The shortcomings in the system “need to be addressed to ensure a secure environment for health data,” said the main report, adding that the findings “raise concern” about the effectiveness of security safeguards for personal health care information.

President Barack Obama has set a goal for every American to have a secure electronic health record by 2014. Eventually, hospitals and doctors would be able to share instantly patients’ clinical information online. That could prevent life-threatening medical mistakes like giving a patient unconscious in the emergency room a drug to which he’s allergic. It could also save money by cutting duplicative lab tests and scans.

Auditors for the inspector general did find that the government agency leading the push for electronic records has put in place some requirements for safely transmitting computerized medical data.

However, that same agency has not issued general security requirements for the computer systems at hospitals and doctors’ offices, systems on which the information would be created, shared and stored. It’s a little like putting a big lock on the front door of the house, but leaving the garage door open.

To underscore the point, the second audit examined computer security at seven large hospitals in different states and found 151 security vulnerabilities, from ineffective wireless encryption to a taped-over door lock on a room used for data storage. The auditors classified 4 out of 5 of the weaknesses uncovered as “high impact,” meaning they could result in costly losses, even injury and death.

The government is offering rewards and penalties to encourage hospitals and doctors’ offices to adopt electronic medical records. Incentive payments could total as much as $27 billion over 10 years. Providers who insist on clinging to paper records will eventually face cuts in Medicare payments.

Responsibility for computer security is divided among several agencies in the Health and Human Services Department. The main ones are a unit called the Office of the National Coordinator, which is spearheading the drive to computerize records, and the Office of Civil Rights, which oversees the enforcement of existing privacy laws.

The inspector general said the coordinator’s office has not asserted sufficient leadership on security, and the civil rights unit needs to redouble efforts to safeguard electronic privacy.

In a written response, the coordinator’s office said it’s trying to balance between encouraging the adoption of electronic records and adding burdensome requirements. But it agreed to “actively explore” requiring stronger safeguards.

In its response, the civil rights unit questioned whether investigators could draw sweeping conclusions from audits of seven hospitals, and added that it regularly performs compliance reviews on health care facilities that report a breach affecting 500 people or more.

The hospitals were located in California, Georgia, Illinois, Massachusetts, Missouri, New York, and Texas. For security reasons, they were not identified. But the list of vulnerabilities read like a road map for hackers.

All of the hospitals had access control vulnerabilities, including inadequate passwords, computers that did not automatically log off inactive users, and unencrypted laptops that contained patient data.

Most of the hospitals had problems with wireless access, including inability to detect unauthorized intrusion, lack of continuous monitoring, and in some cases the absence of a firewall separating wireless from other internal networks.

Another common problem was that hospitals were slow to update their computer software to defeat known security bugs.

FCC unveils cyber defense website for small businesses

The Federal Communications Commission (FCC) on Monday announced the launch of a new website designed to help small businesses protect against cyberattack.

The site -- fcc.gov/cyberforsmallbiz -- includes links to vendor, nonprofit and government resources, including materials from the National Cyber Security Alliance (NCSA) and a PowerPoint presentation from the National Institute of Standards and Technology.

The site also contains a top 10 list of tips for small businesses. They include training employees, installing patches, limiting access and regularly changing passwords.

The FCC launched this initiative, in partnership with business consulting group SCORE and the Small Business Administration, to educate small companies on how to best leverage broadband to drive growth.

"While it is critical to secure the government and large industry from cyberthreats, it is vital that cybersecurity for small business be in this equation," FCC Chairman Julius Genachowski said in a news release.

Small and midsize businesses have been hit particularly hard in recent years by hackers who use malware to steal their corporate bank account credentials, which they use to wire out large amounts of cash, sometimes hundreds of thousands of dollars at a time.

Experts have said these organizations should consider additional steps, such as dedicating machines only for online banking use.

Original Appearance: http://www.scmagazineus.com/fcc-unveils-cyber-defense-website-for-small-businesses/article/203061/?DCMP=EMC-SCUS_Newswire

OpenID Warns Of Serious Bug

Facebook, Google, and Yahoo are among the millions of websites that use the single sign-on technology.

By Mathew J. Schwartz InformationWeek
May 09, 2011 03:21 PM

The OpenID Foundation last week released a security bulletin warning of a serious bug that leaves the authentication mechanism, used by websites to share users' identity credentials, open to attack. In particular, some implementations of OpenID's attribute exchange (AX) don't verify that information passed by AX has been signed.

According to OpenID, "If the site is only using AX to receive low-security information like a [user's] self-asserted gender, then this will probably not be a problem. However if it is being used to receive information that it only trusts the identity provider to assert, then it creates the potential for an attack."

No attacks have been spotted that exploit this flaw, according to the OpenID Foundation. But the threat is that an attacker could use it to "modify information passed between parties and impersonate a user," said John Fontana, an evangelist with Ping Identity, in a blog post.

The OpenID suggested fix for vulnerable applications is "modifying application code to accept only signed attribute values, as an initial step."

Already, "the researchers contacted the main websites impacted, and those sites have deployed a fix," said OpenID, although it declined to name the affected sites. It also said that "OpenID Foundation board members have worked to identify other websites that were impacted and similarly have them deploy a fix."

The most notable OpenID-based vulnerable application is OpenID4Java. To mitigate the vulnerability, OpenID recommends updating that application or any dependent libraries--such as Step2--to the latest version of OpenID4Java (0.9.6 final). Meanwhile, the Kay Framework, which was vulnerable, has been patched as of version 1.0.2. "Other libraries may have the same issue though the default usage of services/libraries from Janrain, Ping Identity, and DotNetOpenAuth are not susceptible to this attack," according to the security bulletin.

Essentially a form of single sign-on for the cloud, OpenID has been adopted by a number of websites and businesses, including Google, Facebook, Flickr, Microsoft, WordPress, Yahoo, and Zappos. As of December 2009, the OpenID Foundation reported that there were over 9 million websites that used OpenID to allow users to register and log in to at least some portion of the site. A number of government agencies have also backed OpenID.

Last year, Google proposed securing account data on websites that relay user credentials--for example, using OpenID--through a process known as PseudoID. The system, which is backwards-compatible with OpenID, would prevent attackers from linking a set of stolen sign-on credentials back to a user's account on referring websites.

original appearance:  http://www.informationweek.com/news/security/vulnerabilities/229403066

Convergence Could Make Life Easier and Less Expensive

The term “convergence” gets used a great deal in the smart card industry. Possibly that is due to the many commonalities that exist across the many seemingly distinct and independent markets where smart cards are becoming more and more mainstream in the United States. For example, what does a smart card that is used to securely access a cloud-based Internet service provider like a prescription drug retailer have to do with a smart card that lets me park my car in the commuter parking lot and board the bus that takes me to my job each day?

Well, in reality, these two seemingly independent applications for smart cards–as an identity token that stores a digital credential to access a cloud-based retailer and as a payment token that makes the parking gate go up and down and the green light go on when I board the commuter bus–are performing exactly the same function. Both uses are providing a trusted identifier to the systems they are connecting to and using some attribute or privilege associated with this identity to allow access to a protected entitlement–such as my prescription with the pharmacy or my prepaid or credit-secured parking and bus passes.

So why aren’t we using the same secure identifier for both services–or converging these two applications onto a single smart card token? That is exactly what some smart people in the federal government and the security and payments industry are trying to work out. If you follow the Smart Card Alliance, you have heard of the Personal Identity Verification (PIV) credential and the FIPS 201 standard that are the foundation of more than 10 million federally-issued secure IDs, including the Department of Defense (DoD) Common Access Card (CAC). Representatives from the DoD, the Washington, DC, commuter rail system (WMATA), and the DC Government are all trying to work out a convergence plan that would allow DoD personnel’s CAC cards or the DC government-issued ID cards to be used to access the parking lots, buses, and trains that make up the WMATA commuter transportation system. The key to this successful convergence around a common ID card is to get each system to recognize a common unique identifier and then use each independent service’s back-end systems to determine if the attributes that are stored in those systems and linked to that identifier can independently grant access to the DOD building, or the DC Government licensing web site, or the parking lot where it is presented. Let’s encourage these types of creative uses for smart card technology so that more systems can focus on convergence opportunities that will make it easier for consumers and less expensive for government and transportation authorities to operate their systems.

You may have heard the recent announcement of the final release of the National Strategy for Trusted Identities in Cyberspace, or NSTIC. The NSTIC program is being led by the Department of Commerce with support from the Department of Homeland Security, and is a project advocated by Obama administration since President Obama took office. The strategy document was released this month and sets a definitive course to eventually rid ourselves of insecure user names and passwords. The NSTIC is a bold example of how government can provide leadership and direction without dictating to private industry how to do it, which rarely works out well. I attended the launch meeting held at the Chamber of Commerce in Washington, DC, on April 15th. One of my colleagues, Don Thibeau of the Open Identity Exchange, aptly called the launch meeting “the Woodstock event for the identity security crowd.” Everyone who has a stake in the Internet security and e-commerce markets was present for the launch and Commerce Secretary Gary Locke, Department of Homeland Security Deputy Secretary Jane Lute, White House Cybersecurity Advisor Howard Schmidt, and the NSTIC Program Office Director Jeremy Grant, all gave enthusiastic endorsements for the plan. The NSTIC plan calls for the development of open, standards-based, interoperable, voluntary digital identity credentials that can be shared across multiple parties; these credentials would limit or reduce the proliferation of weak identifiers such as user names and knowledge-based (e.g., mother’s maiden name) passwords to access Internet services. We only hope that in the months and years ahead, the lessons learned from the years of planning and developing interoperable smart card-based identity tokens will have a prominent place in the final set of recommended solutions.

This article is excerpted from the April 2011 Smart Card Alliance's Executive Director's Letter. It is written by Randy Vanderhoof. The full letter can be found here. 

Sony breach prompts House data theft hearing

A U.S. House subcommittee has scheduled a hearing Wednesday to examine data protection issues following the massive breach of Sony's PlayStation Network and Qriocity services, which compromised the personal information of 77 million gamers.

The House Subcommittee on Commerce, Manufacturing, and Trade, chaired by Rep. Mary Bono Mack, R-Calif., called the hearing to examine the threat of data theft to American consumers in light of Sony's breach, as well as the network intrusion at email marketing services providerEpsilon.

Bono Mack announced that she intends to introduce a federal data security bill later this year that would provide consumers with additional safeguards, including a provision that they must be notified if their personal information is compromised. Similar notification laws are on the books in most states.

A national data breach notification law has been in the works for a number of years. Several versions have made the rounds, but nothing has cleared both chambers.

This mainly has been due to other Congressional priorities and, more specific to the bills, disagreement over what constitutes a suitable threshold to report a breach.

Though Sony is facing mounting scrutiny after waiting several days to inform customers about its recent breach, company executives do not plan to testify at Wednesday's hearing, a spokesman for Bono Mack told SCMagazineUS.com on Tuesday.

Sony executives declined because the company's internal investigation into the breach is still ongoing, he added. The company has, however, agreed to provide written responses to questions posed by Bono Mack by the end of the day Tuesday.

In a letter sent on Friday to Sony's chairman, Bono Mack wants to know how the breach occurred, why Sony waited to notify customers, and what steps the company has taken to prevent a recurrence.

Sony revealed last Tuesday that attackers stole personal data belonging to PSN and Qriocity users, roughly a week after both services went offline. A recent investigation into the breach has turned up further compromise, which may affect an additional 25 million users of Sony's online gaming portal, known as Sony Online Entertainment.

“I am deeply troubled by this latest data breach,” Bono Mack said in a statement. “It reinforces my long-held belief that much more needs to be done to protect sensitive consumer information. Most importantly, Americans should be quickly informed when their personal information has been hacked, especially in instances like this where there is an obvious potential for large-scale identity theft.”

Wednesday's hearing likely will address the state of ongoing data breach investigations, current industry data security practices and available technologies.

Scheduled witnesses include David Vladeck, director of the Federal Trade Commission's Bureau of Consumer Protection; Pablo Martinez, deputy special agent in charge of the criminal investigative division of the U.S. Secret Service; Justin Brookman, director of the Center for Democracy and Technology's consumer privacy project and Gene Spafford, a Purdue University professor.

Tablet computing: Understanding native tablet security capabilities

Written by: Lisa Phifer

Tablet computing presents a huge productivity opportunity for enterprises, particularly those in certain vertical markets such as health care. Today's tablets, such as the Apple iPad, present an opportunity for security solution providers to support their customers by understanding the core security architecture running on these devices.

As described in part one of this two-part technical tip, tablet computers don't run a conventional notebook OS. They run mobile operating systems with their own security models, requiring different endpoint security programs, back-office servers and policies.

Every smartphone OS is somewhat different, but they have improved native security capabilities over the years to address key enterprise risks.

• Authenticated access -- If a tablet is lost, stolen or left unattended, enforcing native device-level authentication (PINs, passwords) can reduce the risk of a stored data breach or device application and connection misuse.

   

• Anti-loss measures -- Native remote lock, find and wipe capabilities can often be used to recover a lost tablet or permanently prevent it from becoming a security liability, including tablets issued to employees that no longer work for an enterprise.

   

• Authorization -- Mobile operating systems support native techniques like code signing, application data protection, and device feature restrictions that enterprises can use to reduce risks posed by mobile malware or inappropriate use. Tablets don't come with antivirus, antispam, or intrusion detection, but such measures can be obtained from third parties.

   

• Data protection -- Mobile operating systems provide native support for security Web and email traffic with SSL/TLS, Wi-Fi traffic with WPA2, and selected VPN protocols. BlackBerry and Apple support device-level data encryption to protect data stored on a tablet. Android currently does not, but third parties do sell file/folder encryption.

   

• Device management -- Solutions exist to centrally provision tablets, enforce their security settings, and monitor their usage, but range from native to third party. BlackBerry and Apple (with iOS4) provide native device management hooks; Android is limited to a small subset of ActiveSync.

For solution providers, these native tablet security capabilities and third-party tools can generate new revenue opportunities. For example, many enterprises are concerned about uncontrolled use of Apple iPads and Samsung Galaxy tablets, but have not established their own infrastructure to address them. Solution providers can fill this gap by offering rapidly activated cloud-based or managed on-premises mobile device manager services for tablets. Providers can also help back-fill native tablet security gaps by reselling or integrating third-party mobile security tools as market demand grows.

Using tablets to deliver on-site security services
Finally, solutions providers may find that tablets are an ideal form factor from which to deliver on-site services to customers.

Today's tablets are extremely portable, wireless-enabled devices that can conveniently run diagnostic tools. For example, Wi-Fi network discovery apps ("stumblers") are readily available for iOS and Android tablets -- these tools can speed and simplify a quick search for potential rogue access points. Once connected to a customer's WLAN, tablets can run apps such as ping, traceroute, port scans and SpeedTest, providing quick insight into what's actually connected to a customer's network and where vulnerabilities might lie. While tablets lack the persistent storage and horsepower of a notebook, they can be an inexpensive, handy and impressive addition to a provider's toolbox.

Furthermore, today's tablets are excellent communicators. The latest tablets have high-resolution still and video cameras, making it easy for on-site technicians to record what they see, securely share and quickly discuss it with off-site specialists. Mobile tools such as Skype and enterprise VoIP clients that run on tablets can be an inexpensive way to improve collaboration and deliver results to customers in near-real-time.Tablets can even be connected to projectors to make impromptu sales or training presentations.

Solutions providers, such as other on-the-go workforces, can also use tablets to readily research problems on the Web and answer customer questions. Providers are less likely to carry a dedicated eReader for this purpose, but all new tablets can run eReader and Acrobat Reader apps, letting on-site installers download manuals to look up parameters and values. Field support technicians can use tablets to access Internet-based maps and navigation tools, getting where they need to be with less delay or hassle. And so on.

These are just a few of the ways that tablets can benefit a security solution provider. Today's tablets are a truly novel form factor, far more convenient than old tablet PCs, and much better at displaying information than smartphones. From reselling tablet security and management software to using tablets to improve on-site service efficiency and effectiveness, tablets pose many new opportunities worthy of consideration.

Lisa Phifer is vice president of Core Competence Inc. She has been involved in the design, implementation and evaluation of networking, security and management products for more than 25 years, and has advised companies large and small regarding security needs, product assessment, and the use of emerging technologies and best practices.

Original appearance: http://searchsecuritychannel.techtarget.com/tip/Tablet-computing-Understanding-native-tablet-security-capabilities?asrc=EM_EVM_2-13753318&Offer=mn_eh101810CHITWELC_4

More customers exposed as big data breach grows

By Jonathan Spicer and Maria Aspan

NEW YORK (Reuters) - The names and e-mails of customers of Citigroup Inc and other large U.S. companies, as well as College Board students, were exposed in a massive and growing data breach after a computer hacker penetrated online marketer Epsilon.

In what could be one of the biggest such breaches in U.S. history, a diverse swath of companies that did business with Epsilon stepped forward over the weekend to warn customers some of their electronic information could have been exposed.

Drugstore Walgreen, Video recorder TiVo Inc, credit card lender Capital One Financial Corp and teleshopping company HSN Inc all added their names to a list of targets that also includes some of the nation's largest banks.

The names and electronic contacts of some students affiliated with the U.S.-based College Board -- which represents some 5,900 colleges, universities and schools -- were also potentially compromised.

No personal financial information such as credit cards or social security numbers appeared to be exposed, according to the company statements and e-mails to customers.

Epsilon, an online marketing unit of Alliance Data Systems Corp, said on Friday that a person outside the company hacked into some of its clients' customer files. The vendor sends more than 40 billion e-mail ads and offers annually, usually to people who register for a company's website or who give their e-mail addresses while shopping.

"We learned from our e-mail provider, Epsilon, that limited information about you was accessed by an unauthorized individual or individuals," HSN, also an e-commerce operator, said in an e-mail to customers on Sunday.

"This information included your name and e-mail address and did not include any financial or other sensitive information. We felt it was important to notify you of this incident as soon as possible."

Citigroup customer names and some credit card customers' e-mail addresses -- but no account information -- were part of the data breach, the third-largest U.S. bank said on Saturday.

The College Board, which administers the SAT admissions tests, on Saturday warned students about the breach and asked them to be cautious about receiving "links or attachments from unknown third parties," according to two e-mails reviewed by Reuters.

The not-for-profit organization is in contact with more than 7 million students, according to its website. It did not immediately return calls for comment.

PROBING FOR ANSWERS

Law enforcement authorities are investigating the breach, though it was unclear on Sunday how many customers or students had been exposed. Epsilon is also looking into what went wrong.

"While we are cooperating with authorities and doing a thorough investigation, we cannot say anything else," said Epsilon spokeswoman Jessica Simon. "We can't confirm any impacted or non-impacted clients, or provide a list (of companies) at this point in time."

Capital One, which also runs a bank, and Walgreens, the largest U.S. drugstore, said the Epsilon hacker accessed its customer e-mail addresses, but no personally identifiable information.

TiVo, a maker of digital video recorders, said the information that was obtained was limited to e-mail addresses and clients' first names.

The incident comes three years after hackers penetrated Heartland Payment Systems, a credit and debit card processor, in one of the biggest identity-theft cases in U.S. history.

In that case, notorious hacker Albert Gonzalez led a ring that stole more than 40 million payment card numbers, and was later sentenced to 20 years in prison.

On Friday, JPMorgan Chase & Co, the second-largest U.S. bank, and Kroger Co, the biggest U.S. supermarket operator, said that some customers were exposed as part of the Epsilon data breach.

Citigroup announced that it had been affected on Saturday evening. Spokesman Sean Kevelighan said the bank started informing its customers of the breach on Friday through a link on its website.

Some of Epsilon's other clients include Verizon Communications Inc, Blackstone Group LP's Hilton Hotels, Kraft Foods Inc, and AstraZeneca.

Original Appearance: http://finance.yahoo.com/news/More-customers-exposed-as-big-rb-3522563504.html?x=0

An Integrated and Cost-Effective Solution for Access Control and Data Encryption

By: DigitalPersona

Mobile devices are exposing data to ever greater threats as notebook computer are now the point of access for employees. Traditionally, Endpoint security solutions include anti-virus, anti-spyware, and firewall capabilities. Frost & Sullivan believes two key components are missing, irrefutable verification of identity and security of data itself.
 
This Frost & Sullivan white paper discusses challenges associated with identity, authentication and data security solutions —price, scalability, and complexity. Additionally, this paper looks at the DigitalPersona solution, which Frost & Sullivan believes provides an effective, standards-based solution for small and medium enterprises while maintaining enterprise class features and functionality.

To read more, click here. Or visit SCMagazine.com to download the white paper for yourself.

SCM Microsystems Gains Ground In Chinese Market With Second Delivery Of Smart Card Readers To China Unicom 

ISMANING, Germany, March 15, 2011 (GLOBE NEWSWIRE) -- SCM Microsystems, a leading provider of solutions for secure access, secure identity and secure exchange and a business unit of Identive Group, Inc. (Nasdaq:INVE) (Frankfurt:INV), today announced its second delivery of high speed SCR3310v2 reader/writers to China Unicom, which now has deployed more than 90,000 SCM reader/writers to facilitate SIM card issuance to its mobile phone customers across China. One of the largest mobile service providers in China, China Unicom is using the SCM reader/writers in point of sales kiosks, stores and retail shops to quickly personalize a SIM phone card for each subscriber on the spot. Responding to the increasing demand for instant personalization of SIM cards at issuance, China Unicom has recently expanded its RPS (remote personalization system) program to its partners' retail shops and point of sales, which are now also enabled with SCM readers.

SCM's SCR3310v2 reader/writers enable China Unicom and its partners to quickly and cost effectively configure the specific services requested by each new or returning customer. Previously, predefined cards were used that enabled specific combinations of services, such as voice and mobile banking, mobile chatting, mobile banking and chatting or mobile info-on-demand. In addition to the inventory challenge this created, it was difficult to ensure the satisfaction of specific requests of every subscriber in every location. By using blank SIM cards and SCM's reader/writers, China Unicom and its partners now can personalize the cards based on each customer's service selection, including the SIM cards used in the popular iPhones and iPads, which China Unicom exclusively provides to the China market.

"Our RPS program has been very successful with customers and has allowed us to provide personalized SIM cards both quickly and more cost effectively," said Gu Ding-Ming, service manager, marketing department of China Unicom Ltd. "SCM's reader/writers are a critical component of this success as they provide the reliability and performance needed to quickly and securely upload large amounts of data to each card. SCM has continued to demonstrate its capabilities to fulfill high-volume orders in a very short timeframe and to our complete satisfaction."

Background of the Chinese GSM Market

China is the largest single Global Systems Mobile (GSM) market in the world today, with more than 650 million users despite market penetration below 50%, according to a 2009 report of the GSM Association. The majority of mobile phone users in China opt for prepaid plans based on removable SIM cards, which often come with new subscriber benefits in terms of pricing and other advantages. SIM cards also provide flexibility, as service coverage typically is limited to a specific geographic region and it is more cost effective to simply switch out the SIM card and use a local service subscription when traveling from one area to another. The demand for SIM cards in China is significant, and mobile phone operators are rapidly changing their business models to provide quick configuration of cards for subscribers.

About China Unicom

China Unicom provides a wide range of telecommunication services to customers in mainland China, including GSM and WCDMA cellular business, fixed-line voice, broadband and other Internet-related services, information and communications technology services, business and data communications services, and other related telecommunication value-added businesses. As of the end of 2010, China Unicom had 153.37 million 2G subscribers, 14.06 million 3G subscribers, 47.22 million broadband subscribers and 96.64 fixed-line subscribers.

About SCM Microsystems

SCM Microsystems, a business unit of Identive Group, Inc. (Nasdaq:INVE) (Frankfurt:INV), is a leading provider of solutions for secure access, secure identity and secure exchange. The company offers the world's broadest range of contact, contactless and mobile smart card reader and terminal technology, digital identity and transaction platforms, as well as systems that integrate physical and logical access control. SCM's smart card-based products and solutions are utilized around the world to enable security and identification applications, transaction systems, eHealth and eGovernment programs and physical access systems.

Original Appearance: http://www.thestreet.com/story/11043947/2/scm-microsystems-gains-ground-in-chinese-market-with-second-delivery-of-smart-card-readers-to-china-unicom.html

Crafty OddJob malware leaves online bank accounts open to plunder

A newly revealed Trojan dubbed OddJob, designed to keep online banking sessions open after customers think they have logged off, is the latest of example of just how dangerous creative malware developers have become.

Securit