Federal Data Security Law: 'Careful What You Wish For'

A federal cybersecurity law edged closer to reality late last week when the Senate Judiciary Committee approved a bill to protect the personal data of Americans. It's exactly what many security experts have been calling for - one federal law that would supersede the growing mountain of state data security laws and give enterprises a simplified, one-size-fits-all roadmap to work from. The bill is a bipartisan effort sponsored by Chairman Patrick Leahy, D-Vt., and co-sponsored by former Chairman Orrin Hatch, R-Utah, that would, among other things, force companies and data brokers to institute data privacy and security programs. Also see Mass 201 CMR 17: A Survival Guide for the Anxious And yet, when asked if a federal law is a good idea Tuesday during a panel discussion on the seventh-annual Global Information Security survey, which CSO and CIO magazines conducted with PricewaterhouseCoopers (see survey results here), one attendee who happens to work for the federal government deadpanned, "Careful what you wish for." That seems to be the consensus among IT security pros these days.

But in a recent, informal and unscientific poll CSOonline conducted on LinkedIn, a majority of respondents expressed doubt that a federal law would make their jobs easier. True, the patchwork of state laws can indeed be confusing to companies looking for a one-size-fits-all approach to security compliance. If anything, they said, the opposite would probably be the result. Here's what four respondents said: Gregory Anderson, desktop security SEPM lead manager and wise application packager at Qwest CommunicationsI have no faith in the U.S. government to implement useful strategies and security measures that don't fall completely apart when political cowards take the reins. The question we asked in various LinkedIn forums was if a federal cybersecurity law was the right way to proceed.

James McGovern, Hartford, Conn., chapter leader for the Open Web Application Security Project (OWASP)One thing I believe is missing is that the government needs to acknowledge that while their security practice is probably more rigorous through the lens of process than their enterprise counterparts, they can learn something from enterprises in terms of community sharing of knowledge, ability to work under scenarios of smaller budgets and how to accomplish the job with less bureaucracy. When was the last time a government CIO or enterprise architect ever traded notes with their enterprise peers? We don't need more enforcement, but collaboration. Good security requires understanding multiple perspectives and not thinking in such an insular manner. And, the Personal Data Privacy and Security Act isn't really about breaches but more about the legal and punishment aspects.

Michael S. Black, manager of information security operations at Barclaycard U.S.Well, the Data Breach Notification Act has an exemption for data that "was rendered indecipherable through the use of best practices or methods, such as redaction, access controls, or other such mechanisms, that are widely accepted as an effective industry practice, or an effective industry standard." It doesn't really have any teeth, does it? So we are left with PR and not a framework to increase security. David Robbins, director, systems development at the Taubman CompanyNo, it is not. It's something to let politicians thump their chest and say "We are working hard to help you," but it actually doesn't help the average person whose data gets stolen and resold, and has his credit destroyed. Powers not enumerated in the Constitution are relegated to the states or the citizenry. Assistance with oversight would probably be viewed in the same light - with frivolity.

The feds have outsourced the production of many electronic components for our military, to the point where we may become crippled should an escalated conflict occur. Breaches in security will have no consequences except when brought forth to a committee. How will this secure us? That's the Congress, the same people who vote on bills that they don't really read, or for that matter, bills that haven't been completely written. Will AT&T be under greater scrutiny, or will they buy off the politicians?

China's online video piracy jumps to Internet TVs

Internet-linked televisions, many containing peer-to-peer download tools, are winning buyers in China despite piracy concerns and a battle between government factions over how to regulate the industry, according to analysts. The devices allow downloads of movies and TV series, often through tools such as Xunlei, offered by a Chinese peer-to-peer download network operator that was sued last year for copyright infringement by members of the Motion Picture Association. China's wealthy elite have taken well to Internet-connected TVs in the months since major vendors started selling them in the country. But one government regulatory body sees the TVs as a threat to profits at China's state-owned cable operators.

Xunlei is one of several peer-to-peer download tools that Internet TVs are using in China, said Natkin. And as authorities have taken steps toward regulating the Internet TV industry, at least two film distributors have unveiled plans to file copyright lawsuits against the TV makers themselves in recent weeks. "Various content providers are sensing the attitude of the authorities and jumping on the related opportunities to advance or protect their own interests," said Mark Natkin, managing director of Marbridge Consulting in Beijing. Others include PPLive, PPS.tv and a service from Sohu, which also runs a major Internet portal. Sales of Internet-connected TVs in China will reach 500,000 this year and grow to about 14 million by 2013, technology consultancy iSuppli forecasts. Haier, a major Chinese vendor of household appliances and electronics, has content deals with Xunlei and Sohu for its Internet TVs, said a Haier employee reached by phone who asked not to be named.

A 42-inch Internet TV costs around 7,000 yuan (US$1,030) in China. Online film distributor Union Voole Technology has filed a separate suit against TCL. When asked about the suits, the Haier employee said the availability of pirated videos on Xunlei or other download networks was "a problem in their own operation." Haier chose Xunlei as a content partner because the service is convenient and has a large range of content, he said. Chinese online video content provider NetMovie.com recently said it plans to file a copyright infringement lawsuit against Haier and three other major Chinese vendors selling Internet TVs, Changhong, TCL and Hisense. Xunlei, widely popular among Chinese PC users, says it oversees tens of millions of downloads each day. No one turns black to white in one night." Pirated DVDs, software and CDs are often sold openly on street corners and in small shops across China.

The removal of pirated content from Internet TVs in China will be a slow process, said Michael Qiang Zhang, an analyst at In-Stat. "It's turning to the legal market, but on the way of course you have some pirated content," he said. "You can't actually avoid it. Copyright owners have also complained about pirated content appearing on Chinese streaming video Web sites such as Youku.com and Tudou.com. One Chinese regulator, the State Administration of Radio, Film and Television (SARFT), has seen Internet TVs as an unwelcome source of competition for state-owned cable operators. On top of the lawsuits, China's Internet TV makers face a wave of regulation that could slow their industry's growth. The peer-to-peer download networks used by the Internet TVs can support streaming, but some TV makers have balked at adding the feature for fear of speeding government regulation of the industry, said Natkin. "The strongest competitive concern about this was from the cable operators," he said. "The cable operators are all part of SARFT's family." SARFT issued an order in August banning companies from channeling Internet content onto TVs without a permit.

Internet TV makers have the backing of China's IT ministry, which wants to regulate the industry but "not to kill it," Zhang said. But it is unclear whether any companies have applied for such a permit, and Internet TVs are being sold just as they were before the order. "I think nobody actually cares," said Zhang. That backing may have protected them from the permit order. Japan, where many TV makers are based, may lead adoption of the devices, but Europe and North America will also see fast growth, he said. Internet-linked TVs are being promoted globally by top manufacturers, said Randy Lawson, a senior analyst at iSuppli. Global sales of Internet-linked TVs will reach 15 million this year, about as much as will be sold in China in five years, according to iSuppli.

Nortel users need to keep tabs on Avaya integration plans

The biggest issue facing Nortel enterprise customers on the heels of Avaya's $900 million purchase of that business is product overlap, consolidation and subsequent support, analysts say. Now comes the uneasy task of sifting through the product portfolio and eliminating redundancies - an ordeal that could leave Nortel and even Avaya users with a shortened life span on their investments. "There may be some surprises there," says Bob Hafner, an analyst with Gartner. "These are going to be two large companies coming together. Avaya emerged as the winning bidder for Nortel's enterprise business Monday, beating out Siemens Enterprise Communications. It's not the easiest thing to do.

Avaya is the leading revenue market share vendor in enterprise telephony, according to Dell'Oro Group, while Nortel is No. 4. (See our test of Avaya's unified communications platform.) Less overlap will be found in routers, switches and other infrastructure products, where Nortel has a larger market share and installed base than Avaya. "The biggest issue for users is, 'Show me the [product] road map,'" says Henry Dewing of Forrester Research. "They want to see hardcore product plans [and] how they are going to actually consolidate product lines." Avaya has pledged near term support for the Nortel enterprise products, including those serviced by Verizon, a Nortel reseller. These things never go without issues, problems or concerns." Slideshow: Rise and Fall of Nortel   Significant overlap is expected in the IP telephony/unified communications portfolios of both companies - IP PBXs, handsets and call management software. Verizon filed motions last week seeking assurances that Avaya would continue to support the Verizon accounts, which the carrier says include many federal law enforcement agencies. "I'd be surprised if that issue doesn't work itself out," says IDC analyst Abner Germanow of the Verizon/Avaya impasse. "I'd have a hard time believing they'd leave the U.S. government out to dry." Nonetheless, Germanow is advising Nortel customers to accelerate any assessment or planning activities in light of the Avaya takeover. "They should figure out where their own needs lie and how to most effectively migrate," he says. "They should hold companies to their multi-vendor visions - that open means open." Gartner's Hafner agrees. "Customers need to pay attention to what's going on in the [merged] organization" to detect any potential distractions or turf battles that may adversely affect them, he says. For a recap of 2009's hottest tech M&A deals, check out our slideshow. 

Microsoft plans six patches next week, ties November record

Microsoft today said it will deliver six security updates Tuesday, less than half the number it issued last month, to fix flaws in Windows and Office. The six slated for next week, however, tie the record for the most issued in November, traditionally a light month for Microsoft updates. The updates will patch a total of 15 separate vulnerabilities , Microsoft said in a follow-up entry to its security response center's blog. "Six is the lucky number this month," said Andrew Storms, director of security operations at nCircle Network Security. "Really, anything less than 13 is a lucky number." Last month, Microsoft released 13 updates that patched 34 vulnerabilities, both records since the company started shipping monthly updates more than six years ago.

In November 2006, the company also delivered a half-dozen security updates. Four of the six affect one or more editions of Windows or Windows Server; the other two will patch Office, specifically Word and Excel. In 2007 and 2008, however, it shipped just two each year in November, while it released only one in 2005. Of the half-dozen updates, Microsoft tagged three as "critical," the highest severity rating in its four-step scoring system, while the remaining trio were labeled "important," the next-lowest ranking. Because there are no outstanding Microsoft-generated security advisories, Storms was at a loss about what next week's updates might fix. "But Bulletin 1 looks interesting," he said, noting that the critical update would patch only Vista and Server 2008. "Historically, you would expect a Vista patch to also affect XP, and maybe even Windows 7," Storms explained. Last month, Microsoft released the first patches for Windows 7's final code. "There aren't any Windows 7 patches at all," Storms said. "So, so far so good." Windows 7 will be worth watching, however. "It will be more interesting down the road to see if Microsoft disclosed bugs they found in Windows 7, and fixed during development, but are just now going back and fixing in the older OSes." Another update to watch carefully next week is the one Microsoft named "Bulletin 3" in its advance notification , the monthly forewarning that includes only the barest of details. None of Tuesday's updates will affect Windows 7, Microsoft's just-released operating system, or the also-new Windows Server 2008 R2, the companion server software.

That update, also rated critical, affects everything version from the aged Windows 2000 to Vista and Server 2008. "I think No. 3 is the big one to watch next week," said Storms. The first update will impact Word 2002 and Word 2003 on Windows, and Word 2004 and Word 2008 on the Mac. Another researcher agreed. "Our sources unanimously suggest that Bulletin 3 will be the issue that needs to be addressed first this month," echoed Sheldon Malm, senior director of security strategy at Rapid7, in an e-mail. "[Users] should take inventory of where Windows versions are within their environments so they can plan testing and roll-out of the patch for Bulletin 3 as quickly as possible." The two Office updates, both important, will address issues in Word and Excel. The Excel update, on the other hand, will patch one or more problems in Excel 2002, Excel 2003 and Excel 2007 on the PC, Excel 2004 and Excel 2008 on the Mac. "The Office updates are interesting, but from what Microsoft gave us today, I think they'll be the kind of file format parsing bugs we've all come to know and love," Storms said today. Earlier this week, Microsoft acknowledged that the bulk of all attacks targeting Office in the first half of 2009 were leveraging a single vulnerability, which Microsoft patched in June 2006. This is the second month in a row that Microsoft has disclosed not only the number of updates it will ship next week, but also the number of flaws those patches will fix. Vulnerabilities in Office file formats have been a treasure trove for hackers, who have successfully exploited them for years.

And that's a good thing, said Storms. "That's great," he said. "It aids the planning process, because six bulletins could be six vulnerabilities or 20." Microsoft will release the six updates at approximately 1 p.m. ET on Nov. 11.

Arm uses laptops to protect mobile phone turf from Intel

Arm Holdings is positioning its chips as the main processors in the low-end laptop market, but does not expect these chips to account for a significant part of its revenue, an executive said on Friday. The company forecasts that royalties from its microprocessors in laptops and other entry-level computing devices may account for between 5 to 10 percent of its royalty revenue in five years, he added. It decided to enter this market mainly to counter Intel's moves in the mobile phone market, Simon Segars, Arm's executive vice president and general manager of its Physical IP Division, said in an interview.

Unit sales in the mobile phone market are likely to be far larger than the low-end laptop market, Segars said. The main reason why Arm is targeting the low-end laptop and desktop market is that it would like to place significant hurdles to Intel's bid for the mobile phone market in which Arm has a dominant position, Segars said. There is also the trend for sophisticated mobile phones to have up to four or five Arm processors in them, he added. If mobile phone vendors like Nokia and Samsung want to get into computing devices, Arm would prefer they use its chips rather than look to alternate suppliers like Intel, he added. "We are more worried about Intel encroaching into the high-end of smartphones, than we are about netbooks," said Segars. Arm designs processor cores that are licensed to chip makers and vendors like Freescale, Texas Instruments, Marvell, and Nvidia. If Arm is successful in devices like netbooks, it will be a nice incremental revenue for the company, he added.

These chip vendors then use the cores in chips known as SoCs (system-on-chip) designed for mobile phones, including smartphones, and some of these companies are now targeting the entry-level laptop market. Arm last month increased the clock speed of its Cortex A9 processor to 2GHz, positioning it against Atom, Intel's processor for the entry-level computing market. Some small computer makers like Pegatron have announced entry-level laptops and desktops built around these processors. Arm's low power, and low cost technology helps drive down system costs on fans, and makes the devices power-efficient, Segars said. A mobile version of Windows is already ported to the Arm architecture. Though the Arm architecture can run Linux, including a distribution from Ubuntu, Microsoft has said its upcoming Windows 7 operating system will not support the Arm architecture.

If Windows 7 is ported to its architecture it would certainly help, but its absence is not "the end of the world" for Arm, Segars said. Kids and many other users do not run office applications but use their computers for YouTube, Facebook, e-mail and other online applications, according to Segars. "For that you don't need office applications, but things like video codecs," he added. Linux computing is taking off, and a lot of people are happy doing web browser based computing, and accessing office and other applications in the cloud, he added. Arm announced earlier this month that Adobe Flash Player 10.1 will be supported on Arm-powered devices. "Our view is that Microsoft would have to be crazy to ignore us forever," Segars said. As it is backed by Google, the new operating system may also make Microsoft change its mind on a port of Windows 7 on Arm, Segars said. Google's Chrome operating system could also change the low-end laptop market in favor of Arm, as the operating system will support both Arm and x86 processors.

Restaurants sue vendors after point-of-sale hack

When Keith Bond bought a computerized cash register system for his Broussard, Louisiana, restaurant, he thought he was modernizing his restaurant. His story reads like a warning for small businesses, who in connecting their businesses to the Internet, have also become prey for sophisticated cyber-criminals. Today, he believes he was unwittingly opening a back door for Romanian hackers who have now cost him more than US$50,000. Bond's is one of more than a half-dozen Louisiana restaurants that have sued the makers of their point-of-sale system, alleging that the companies that made and resold the systems are the ones who should be responsible for fines levied by payment processors following the hack.

Bond says that systems at his Mel's Diner, Part II, were hacked, along with several other restaurants in the region, sometime around March 2008. Investigators told him that the systems were compromised by Romanian hackers who used the devices' remote access software to steal credit card numbers from the systems. The criminals took those credit card numbers and then used them to make fraudulent purchases throughout the U.S., he said. This software let Bond's reseller, Computer World, provide remote support to the systems. In the class-action lawsuit, Bond and the other plaintiffs allege that their point-of-sale systems were out of compliance with the Payment Card Industry Data Security Standard (PCI DSS), which defines how secure the big credit card companies expect their merchants' computers to be. He was then assessed tens of thousands of dollars in fines and chargeback fees generated by the 699 credit card numbers that were stolen from his three point-of-sale devices. "Our clients are restaurants," said Bond's lawyer, Charles Hoff, in a statement. "They are food experts, not technologists. Bond and others blame the maker of his Aloha point-of-sale system, Radiant Systems, and its Louisiana reseller, Computer World (Computer World is not related to IDG's ComputerWorld magazine). After the hack, Bond had to spend close to $20,000 to audit his systems.

When major players in the hospitality industry such as Radiant Systems and its distributors say their software and business practices are PCI-DSS compliant, our clients trust them." The class-action lawsuit was filed in October but was not widely known until the privacy blog DataBreaches.net disclosed it last week. Citing company policy, a Radiant spokeswoman declined to comment on the lawsuits, but in an e-mailed statement, she said that the company believes that the allegations are without merit. "These customers were victims of criminal acts almost two years ago. Another similar lawsuit was filed against Radiant and Computer World in April by plaintiffs in Georgia. Unfortunately, in today's world criminal acts like these are not uncommon in the restaurant industry," the statement read. There's no level of responsibility with the processor, the reseller or with Visa Mastercard. Bond doesn't buy that. "You're buying an expensive point-of-sale system," he said. "But when you're compromised, Visa and Mastercard come after the merchant.

So the merchant is the person who is suffering." The lawsuit claims that Visa warned Radiant and Computer World that they were not PCI compliant the year before the hack, but that merchants were never notified of these problems, even though they were the ones who ultimately had to pay big fines. The alert warned Aloha users to disable a Remote Desktop feature on their equipment if it's not being used to provide remote support to the point-of-sale system. That's a real problem, said Avivah Litan, an analyst with the Gartner research firm. "Merchants should be notified directly when Visa or MasterCard issue alerts about non-compliant software," she said in an e-mail interview. "Restaurants are in the business of selling food; they should not be expected to be experts in the intricacies of credit card processing certification processes, especially when they are not even privy to most of the communications surrounding them." Radiant warned about the problem, according to a security alert posted by a San Francisco Bay Area Radiant reseller. The plaintiffs in Bond's lawsuit say they received no such alert. According to Bond, Computer World used this Remote Desktop feature to access his systems.

Computer World did not respond to a request for comment on this article. To make matters worse, Computer World had set up his and other restaurants with the same default password: "Computer," Bond said.

Week in Google news: Loses Apple board ties, spiffs up Google Docs

A look back at the week's biggest Google-related news stories:   Apple severs board ties with Google  The final ties have been cut between Apple's and Google's board, with Arthur Levinson (he had been serving as an independent member on both the Apple and Google board of directors) resigning from the Google board. Not to be confused with the Google Books project, but possibly a threat to Amazon.com and other online booksellers.   Google bullish on economy The company posted increases in Q3 revenue and earnings, beating Wall Street expectations. This follows the departure of Google CEO Eric Schmidt from Apple's board in August shortly after Google announced it would be competing head on with Apple in the operating system market with Chrome OS just as it was competing with the iPhone with Android.   Amazon, meet Google Google revealed plans for Google Editions, an online store offering digital books to users of various devices, from e-book readers to laptops and cellphones. Google CEO Eric Schmidt said in a statement. "While there is a lot of uncertainty about the pace of economic recovery, we believe the worst of the recession is behind us and now feel confident about investing heavily in our future."   Google's cloud security double talk  Computerworld reported that a group called Consumer Watchdog fired off a letter to the head of the Los Angeles City Council's Budget and Finance Committee, claiming that Google was talking out of both sides of its mouth in pitching its Google Apps to the city.

Unfortunately, Google didn't get all the bugs out first.   Google on the prowl for website malware  Google on Monday rolled out a service to help Webmasters identify malware that may have been slipped into their sites. The watchdog group said Google assured the city its cloud-based apps were safe, but separately acknowledged risks in a financial filing with the federal government.   Google Docs get upgraded, but bugs surface  Google pleased users of its Docs offerings by introducing folder sharing, an ability to upload multiple items to Docs simultaneously and by improving the interface. The new tool uses automated scanners to show Webmasters of sites flagged as "unsafe" just what the offending code is.   Google Voice gets friendly Google has started allowing early adopters of Google Voice  to invite friends to join them.   Google's Postini goes on the fritz  Users of the messaging security and archiving service were festering when service problems emerged during the week. For more on Google, visit Network World's independent Google community, Google Subnet. By week's end, Google had fixed the delayed e-mail delivery issues, but some customers were unhappy with a lack of communication on Google's part, Computerworld reports.   Also, here's a look back at the previous week in Google news.