Robert Lemos

Spearphishing worries follow Epsilon breach

Security experts warned Monday that banking customers should worry about a wave of spearphishing attacks utilizing the recently-breached email database stolen from marketing firm Epsilon.

The email addresses leaked during the attack could be used to send targeted attacks to the customers of Epsilon's clients, which include a host of banks such as Barclays Bank of Delaware, CapitalOne, Citibank and JPMorgan Chase. The banks are "freaking out" about the leak, says Avivah Liten, vice president of security research for analyst firm Gartner.

CSO Online

When Clouds Attack: 5 Ways Providers Can Improve Security

Criminals intent on attacking others can lease networks of compromised computers, or botnets, from other criminals serving the underground community. These resources could be considered "clouds" in their own right, but researchers warn that that operators of legitimate clouds need to worry about being used for illicit attacks as well.

In a presentation at the DEFCON hacking conference in August, two researchers did just that. David Bryan of Trustwave and Michael Anderson of NetSPI created a handful of virtual servers to attack a small financial company—a client that wanted to test its security against just such an attack. Rather than renting a botnet from criminals, the researchers used Amazon's Elastic Computing Cloud (EC2) to rent less than a dozen virtual servers to overwhelm the target's network with traffic.

The researchers claimed there was no indication that Amazon detected the attack and called for all cloud providers to take more care in monitoring how their resources are used.

CIO.com

Lessons From a Data Center That's Got Game

Companies developing latency-sensitive applications for hosting in their data centers could take a lesson from the playbook of OnLive.

The startup company, which just had its coming-out party during the recent E3 gaming confab, runs resource-intensive computer games on its servers and streams the action to players throughout the United States. Despite the technical hurdles of delivering real-time games—many of them first-person "twitch" games—to consumers, the service has quickly become popular, says Steve Perlman, the company's CEO.

CIO.com

Cloud-Based Denial Of Service Attacks Looming, Researchers Say

With the help of the cloud, taking down small- and midsize companies' networks is easy, two consultants told attendees here last week.

With a credit card and an e-mail address, security consultants David Bryan of Trustwave and Michael Anderson of NetSPI created a handful of virtual server instances on Amazon's EC2 and used a homemade program to attack the network of a client -- a small business that wanted its connectivity tested.

With only three servers -- although they eventually scaled up to ten -- the consultants took the company off the Internet. The price? Six dollars.

DarkReading

New Services Could Signal Shift In SaaS Security Offerings

Two major announcements this week indicate software-as-a-service (SaaS) security offerings are heating up, becoming both more comprehensive and easier to manage, experts say.

Symantec today announced its Hosted Endpoint Solution (HEP), a service that will allow small and midsize businesses to manage all of their desktop security clients from a single portal.

The announcement came a day after Verizon Business launched a comprehensive cloud security service, rolling antispam, firewall, intrusion detection, and denial-of-service attack protection into a single service that doesn't require on-premise equipment.

DarkReading

Cloud Computing: Early Adopters Share Five Key Lessons

While some large enterprises have moved their information-technology infrastructure to a third-party managed service to save costs, small firms—especially startups—have come to rely on cloud services to cut initial outlays and help them focus on the core services and products.

Infrastructure-as-a-service offerings, such as Amazon's Elastic Computing Cloud (EC2), typically are used by larger enterprises to give research-and development groups flexibility in resources. For startups, eliminating the large capital expenditure of a data center at the outset has allowed many to reduce seed money and keep their burn rates that much lower, says Oliver Friedrichs, CEO of antivirus firm Immunet, which launched its first product last August.

"It's a big win for smaller companies to leverage the cloud because you are really saving a lot—it is really avoiding a large, up-front investment," says Friedrichs. "Five years ago, we would have had to build out a data center and the sheer cost of that would have made it much more difficult to launch our business."

CIO.com

Companies Look To Managed Services To Close Security Gaps

As malware and social engineering attacks become more sophisticated, many companies -- especially small and midsize businesses (SMBs) -- are arriving at one conclusion: We need help.

Nearly three-quarters of SMBs cut or froze their security spending last year, despite 71 percent believing a serious attack would put them out of business, according to a recent survey by McAfee. The cost cutting and lack of expertise has led companies to leave themselves vulnerable to sophisticated attacks, says Michael Sutton, vice president of security research for Zscaler, a provider of Web security services.

"I've never had a trial [of the Zscaler service] for a company of 100-plus users where I haven't been able to go back in a week and tell them about infected machines," Sutton says. "That tells me that they do not have adequate visibility into their networks."

DarkReading

Intel, AMD Compete for Data Center Refresh

Processor makers Intel (INTC) and AMD (AMD) are back to tit-for-tat competition in the server market, and data centers looking to replace their computing hardware stand to gain.

Last week, AMD released its Opteron 6100 Series processor, its top-of-the-line server CPU for two- and four-processor systems. A day later, Intel capped its latest line of processors, adding the Xeon 7500 chip as its alpha dog. Both manufacturers argue that companies are ready to buy again and cutting data center costs by consolidating servers makes sense as firms worldwide emerge from a depressed economy.

CIO.com

Harnessing the Cloud for Hacking

"Security is moving into the cloud ... so the attacks will follow security into the cloud as well," says Marlinspike. "Password cracking is an obvious thing. Normally, it is cost-prohibitive to run CPU-intensive jobs. [With cloud computing] it costs a lot less money than doing it yourself."

At its core, cloud computing is about providing services or infrastructure through the Internet that can easily be ramped up to meet demand. Online giants, including Amazon, Google, and Microsoft, all have services that offer the ability to run an application in a large data center or to rent time on a cluster of virtual computers, allowing customers to tap into large amounts of computing power more efficiently.

Security experts say the performance and costs advantages of cloud computing are already luring cybercriminals.

Technology Review

How to Keep Your Data Center Happy for the Holidays

In the brick-and-mortar world, this holiday season is shaping up to be a wash: More people are shopping, but they are spending less.

The online picture is different, however. Greater numbers of people are going online to shop and spending more. Data collection from retail sites showed that sales were up nearly 14 percent on the Monday following Thanksgiving, known as Cyber Monday, compared to a year ago, according to Web information firm Coremetrics. The amount spent per sale rose 38 percent, the firm says.

The trend highlights the importance of keeping the data centers powering e-commerce sites and online traffic running smoothly, says Dan Blum, principal analyst for the Burton Group.

CIO.com