 |
 |
|
|
|
|
| |
| Secure Information for a Secure Future |
| |
| |
The advanced capabilities of data and online services, combined with the progression to cellular communication opened the floodgates for information — and with it — avenues for attacks.
|
| "Smaller. Faster. Smarter." |
This is the mantra driving high-tech companies in the information and communication arenas to develop innovative solutions. Unfortunately, it has also become the formula of hackers and vandals with malicious intent. Increased bandwidths and greater connectivity options moved the world towards 24/7 online connections and high-speed, global communication. The advanced capabilities for data and online services, combined with the progression to cellular communication has opened the floodgates for information — and with it — avenues for attacks.
|
| "Seriouser and Seriouser" |
The Jerusalem virus, which appeared in late 1987, is considered to be the first file-virus. Although somewhat damaging, such a virus was transferred only from copied diskettes. Unfortunately, however, the improvements in computers brought a parallel progression in the types and impact of attacks. The September 2001 Nimba worm, for example, had six different methods of self-replication. The combined virus and worm attained global proportions within only six hours.
The more malicious the attacks, the greater the damage. The figures for loss of business alone reach millions of dollars in a matter of days. In the battle against hackers and vandals, high-tech companies face a serious challenge. Moreover, security industry experts' predictions indicate that the situation will only get worse.
|
| Bugs + Holes = Security Problems |
With all the innovations in information and communication technology, one could assume that computer systems would be fully protected. But the push for usability has left security issues behind — until they could no longer be ignored. The bugs in systems and the holes in networks (often caused by improper system configurations) make them hacker friendly. In essence, the need for an information security industry grew out of imperfections in the information and communication sectors. Ironically, hackers, vandals, and even unwitting users, have been the impetus for the infant information security industry to blossom. And to make a bad situation worse, industry experts maintain that 60% of information security breaches actually emanate from inside the organization — most of them unintended.
|
| The Changing of the Guards |
| VPN, perimeter security, two-step authentication, content filtering and smart cards are examples of technologies in their infancy, with limited — if any — standards. Looking ahead, these technologies will be at the forefront of tomorrow's security landscape.
|
Antivirus software and firewalls are among the established information security sectors with entrenched market leaders, leaving limited opportunities for other companies in these sectors. But market leaders cannot relax. Instead, they continue to actively meet expanded protection needs by reshaping existing technologies, thereby bringing new solutions to life. Yet, it is clear that while the old mainstays of security such as antivirus and firewall are around to stay, they are not enough. And this need for alternative solutions provides openings for new companies in the market. Technologies including virtual private networks (VPN), perimeter security, two-step authentication, content filtering and smart cards are examples of technologies in their infancy, with limited — if any — standards. Looking ahead, these technologies will be at the forefront of tomorrow's security landscape
|
| Preparing for Action |
Israel deals with numerous aspects of security on a daily basis. Israeli companies combine extensive technological experience — often from the military — with a keen ability to foresee future needs that leads them to adapt technologies. The result: innovative, cutting-edge products. Over 70 Israeli companies are currently involved in information and communication security. When the call to arms comes for information security — and from all indications it is at our doorstep — Israeli companies will be ready to meet the challenge.
|
| Shields, Walls, and a "Washing Machine" |
A look at established Israeli information security companies gives a sense of where the industry is positioned today. "The traditional reactive antivirus is no longer adequate," claims Shimon Gruper, executive VP of eSafe Technologies, division of leading security producer Aladdin Knowledge Systems. They are developing proactive content filtering and antivirus protection in the effort to prevent attacks generically and minimize the threat of viruses and Internet-borne malicious code. Aladdin has taken a pioneering step, according to Gartner Research, "by moving beyond only detecting and preventing virus attacks and focusing more intently on the broader range of preventing malicious code and vandals that come with the exploding use of the Internet."
Check Point made its name synonymous with firewalls and placed firewall solutions at the center of the security arena. But firewalls alone are no longer sufficient to ward off the increasingly sophisticated attacks. A complete solution requires technologies that complement firewalls and produce layered protection. VPN extends the firewall to the network's public connections, such as the Internet, while maintaining privacy. Gap technology (or "air gap") secures the path of data transfer between e-business servers and internal applications by physically separating sensitive systems from untrustworthy networks. Adaptive perimeter security is placed outside the firewall to identify and proactively block attacks on a network.
Hacker attacks causing damage to e-commerce companies, government sites, and even Internet service providers (ISPs) are disturbing news items. A distributed denial of service (DDoS) attack — overloading a victim's network with information requests, preventing the ability to respond to legitimate traffic, and causing astronomical losses — is a threat that has already hit. But as systems become more open and vulnerable, DDoS will continue to be a major concern in the future. Elad Shaviv, Wanwall's VP of marketing and sales, describes their unique DDoS protection solution as a "washing machine" for the ISP. Their solution first detects, then separates out the user being "attacked," while maintaining uninterrupted operation for the other "clean" enterprises.
|
| The Armor of Tomorrow |
If security solutions to date conjure up images of physical barriers, the technologies of tomorrow can be depicted as scramblers, puzzles, and locks and keys. Authentication, verifying that both the user and the content are correct and safe, will be a necessity for secure communications and transactions and a means to combat the rising degree of fraud. Two-step authentication, as Aladdin's Gruper puts it, is a combination of what you have (mobile phone, smart card, or key/token) and what you know (secret pin number or code). Only a correct combination of the two will result in approval.
Encryption has been used since ancient Egypt to maintain the secrecy of material. Asymmetric encryption — combining a public key (code) and a private, individual key — for secure communication is an established technology that is being adapted for information security of the future. Aliroo combines asymmetric encryption with content filtering and antivirus to produce a comprehensive, safe e-mailing package. According to Meir Zorea, the company's CEO, the increased regulations in the financial and healthcare sectors amplify the need for secure e-mail transmission.
Another Aliroo development, digital signature, is set to face the issue of electronic non-repudiation. If repudiation is defined as the rejection or refusal of a duty, relation, right or privilege, non-repudiation is the ability to deny a false rejection or refusal of an obligation with irrefutable evidence. Recent legislation allowing electronic transactions to be used as evidence in a court of law—and the resulting verification of these transactions—signals a direction change in the notarization and authorization practices we know today.
|
| A Smarter Tomorrow |
| Integrating a smart card with PKI will enable private exchanges on an unsecured, public network such as the Internet, in order to meet the security needs of globe-trotting executives who conduct much of their business on the run.
|
It is just a matter of time before smart cards or smart tokens replace magnetic strips as the means of identification, verification, and authentication. A magnetic strip is read by a simple reader, whereas sophisticated smart card readers are, well, smarter, and cannot be accessed by brute force (or "Crayed"). The major credit card companies—Europay, Mastercard and Visa (EMV)—have established the international EMV standard protocol for verification using smart cards. Microsoft's commitment to include certificate authorization (CA), a trusted third party that validates the smart card user into its infrastructure, will also drive the market in this direction. As Motty Alon, marketing director at Algorithmic Research explains, "the certificate, a software file, is like a passport that identifies the person using the public key, which is then verified by the certificate authority. The CA can be a centralized body, such as a notary, or part of a corporation."
Today, wireless data transfers and purchases are vulnerable because of inadequate security. Integrating a smart card with the Public Key Infrastructure (PKI) will enable private exchanges on an unsecured, public network such as the Internet, in order to meet the security needs of globe-trotting executives who conduct much of their business on the run. That's what Aladdin, Aliroo, and Algorithmic Research envisioned with their PKI tokens: private keys for authentication and secured remote access that fit in a pocket. The expansion of m-commerce, as one example, has been hampered by security concerns. PKI solutions that enable accurate identification for secure wireless communication are likely to change that.
Algorithmic Research anticipates the coming of smart cards even further with development of a PKI system for the network server — PKI in a box. Storing all public and private keys centrally will reduce the resources needed for managing the system, including approving certificates and issuing keys.
With a wireless world comes eavesdropping and wiretapping. Utilizing their experience in the Israeli Army, the founders of Snapshield developed a unique telecom line and wireless encryption technology platform that prevents privacy invasion while remaining invisible to the user. "Security is becoming a standard" says Erez Tsur, Snapshield's director of sales and marketing. "Today, security for all voice, fax, and data over wireless is an added-value option. In the future it will be a basic feature, not only a competitive differentiation factor."
|
| Hack into Opportunity |
Time is not on the side of hackers and their cohorts. Security is a growth industry. As hackers continue to put their wits against state-of-the-art systems, developers will continue to strengthen their defenses. Israeli entrepreneurs have much to gain from sharing expertise and forging strategic alliances — both to protect national interests and to make a major contribution to this burgeoning and challenging market sector. The advancing array of available security options will not prevent the vandals from trying to cause damage, but turning the variety of available technologies into a fine-tuned "security force" will certainly make life for the hacker very difficult.
|
The Trendletter team welcomes your comments.
|
Debbie Yerushalmy
Analyst
The Trendlines Group
|
|
|
|
|
©2002–2008 Trendlines International Ltd. All rights reserved.
Phone: +972.4.958.3323 | postmaster@trendlines.com
Directions |
Privacy Policy |
Site Map
This site contains material copyrighted by third parties.
This site
is best viewed in Internet Explorer version 5 or higher.
|
| |
| |
|
|
|
|
