Data breaches and network intrusions occur because the personal information compromised includes data elements useful to identity thieves, such as Social Security numbers, account numbers, and driver's license numbers. Some breaches do not expose such sensitive information; however, they still expose individuals to identity theft and business to a compromise of their electronic assets and that must be disclosed under Sarbanes-Oxley and various state laws.

Janco has defined a set of tools which enterprises of all sizes can use to be prepared to protect against breaches and intrusion, know when it occurs, and provides the ability to respond quickly when it does happen.

The attack in China and Taiwan is ongoing. In addition with the impact of the earthquake and the associated relief efforts, the attack is having a huge impact. Even if they cannot successfully insert malware, they are killing lots of Web sites right now, because they are just brute-forcing every attack surface with SQL injection, and hence causing lots of permanent changes to the victim Web sites.

In a SQL injection attack, an attacker attempts to exploit vulnerabilities in custom Web applications by entering SQL code in an entry field, such as a log-in. If successful, such an attack can give the attacker access to data on the database used by the application and the ability to run malicious code on the Web site.

Mass SQL injection attacks have increasingly become a security threat. In January, tens of thousands of PCs were infected by an automated SQL injection attack. That attack exploited a vulnerability in Microsoft Corp.'s SQL Server.

Thousands of Web sites have been hit by the attack, he said, noting that 10,000 servers alone were infected by malware on Friday. Most of the affected servers are in China, while some are located in Taiwan. The attackers appear to be using automated queries to the Google search engine to identify Web sites vulnerable to the attack, he said.

The attackers in the more recent outbreak are not targeting a specific vulnerability. Instead, they are using an automated SQL injection attack engine that is tailored to attack Web sites using SQL Server. The attack uses SQL injection to infect targeted Web sites with malware, which in turn exploits vulnerabilities in the browsers of those who visit the Web sites.

The malware injected by the attack comes from 1,000 different servers and targets 10 vulnerabilities in Internet Explorer and related plug-ins that are popular in Asia.

Virtually all organizations must satisfy statutory records retention requirements, including broad-based requirements such as the Americans with Disabilities Act, the Age Discrimination in Employment Act and the Occupational Safety and Health Act. For example, the Sarbanes-Oxley Act impacts all public companies and has been a prime point for regulatory compliance. A few of the many mandated requirements are:

• SEC 17a
• FINRA 3010
• FDIC Advisory
• Investment Advisors Act of 1940 (hedge funds)
• Gramm-Leach-Bliley Act
• IDA 29.7
• FDA 21 CFR Part 11
• OCC Advisory
• HIPAA
• Financial Modernization Act 1999
• Medicare Conditions of Participation
• Fair Labor Standards Act
• Americans with Disabilities Act
• Toxic Substances Control Act
• UK Data Protection Act
• UK Companies Act
• UK Company Law Reform Bill - Electronic Communications
• UK Combined Code on Corporate Governance 2003
• UK Human Rights Act
• UK Anti-Terrorism, Crime and Security Act 2001
• Basel II
• Markets in Financial Instruments Directive

Although many records retention requirements do not impose specific requirements on email or instant messages, Janco has found that approximately 80% of enterprises use email for closing orders or performing other types of business transactions. As a result, email is housing a greater proportion of corporate and other records and so increasingly is subject to statutory records retention requirements.

• Real ID Implementation status
  
• SOX Compliance Requirements
  
• Security Audit Program
  

• Disaster Recovery and Business Continuity
  
• Job Descriptions
  
• 2008 Salary Survey

Security Threat is Increasing

From spyware and phishing to intrusion attempts, the threats attacking todayÂ’s computer networks are more dangerous than ever. Many threats are targeting specific industries with convincing-looking e-mail and phone calls. The hackers hope to direct employees to counterfeit Web sites, in order to harvest passwords and private financial information or steal computer and network resources. The revenue from cybercrime in the United States now exceeds that of illegal drug activity.

Security Threat is Increasing

From spyware and phishing to intrusion attempts, the threats attacking todayÂ’s computer networks are more dangerous than ever. Many threats are targeting specific industries with convincing-looking e-mail and phone calls. The hackers hope to direct employees to counterfeit Web sites, in order to harvest passwords and private financial information or steal computer and network resources. The revenue from cybercrime in the United States now exceeds that of illegal drug activity.

T-Mobile announced the availability of the T-Mobile BlackBerry 8820, which is essentially the Curve with integrated GPS. This new BlackBerry device also supports the T-Mobile HotSpot @Home Mobile WiFi service as well. As you can see on the T-Mobile page you can buy this device now for US$349.99 after rebate and service activation. This seems to be a device for the professional though, as a digital camera is not included with the device.

Other specs include quad-band GSM/GPRS/EDGE (still no 3G love from T-Mobile), 802.11 a/b/g WiFi, Bluetooth, GPS, 320×240 display and microSD card for expansion. It weighs in at 4.7 ounces. It seems a bit blockier than the Curve and with the good accuracy of Google Maps I don’t think I would pick up one of these. Maybe the Curve prices will drop enough for me to swap from my Pearl to the Curve though.