Business IT maturity is expressed, the way IT in totality tags it’s prices for the products and services. Nevertheless, How it recovers its costs? Life as a consultant is tough. I’m not complaining, but we have to find small ways to introduce humour and keep our sanity. I wrote recently about how a consultant can use language clues to quickly assess both business and IT maturity. Sometimes, you don’t even need the clues! One of the ways I can put a sparkle into my day, when I meet a CIO I’ve never met before, at an organization I know nothing about, after a few minutes conversation, I pronounce, “I think your IT funding model is broken!” In every case, they look surprised, then reveal, “How did you know so quickly?” Of course, the answer is, funding models are nearly always broken. However, IT funding is one of the dominant causes for being intact at mid-Level 2 Business-IT Maturity. Below that point, much IT spend is funded by the project. To a degree, business clients underst...

Rock Phish attacks account for 50 percent of phishing incidents and have stolen “tens of millions of dollars” from bank accounts. This is the first time crimeware has been used in a Rock Phish attack. The victims of these phishing attacks get their personal data stolen and are infected by the Zeus Trojan, which is even worst for victims. In 2004 it was the first (and, for a long time, they were the only) gang to employ bot-nets in its phishing infrastructure in order to make the attacks live longer and be more scalable. It also pioneered new techniques in its spam mails so the mail could more easily evade spam filters. Within the past few weeks there has been a new advance — the inclusion of identity theft malware (or Crimeware) into the Rock group’s phishing attacks. While the term "botnet" can be used to refer to any group of bots, such as IRC bots , the word is generally used to refer to a collection of compromised computers (called zombie computers) running programs, usua...

EMC's Interpretation - “At most companies today, security projects are being driven by compliance and audit, so what a surprise that they don’t have alignment with the business! Security practitioners are not working on business problems; they are working on regulatory issues.”Now I’m not going to suggest that all regulation is unjustified and that businesses can’t profit from the level playing field that regulation can create. While effective attacks against 1024-bit RSA keys appear unlikely to emerge in the near term, the community has for some years suggested the prudence of a movement away from 1024-bit key lengths by the end of 2010. The U.S. National Institute of Standards (NIST) recommends in its special publication 800-57, "Recommendation for Key Management--Part I: General http://csrc.nist.gov/publications/nistpubs/800-57/SP800-57-Part1.pdf " (p. 66), that 1024-bit RSA be used to confer data protection only through 2010. Similarly, in May 2003, RSA Labs publishe...

We strive to focus on architectures, methodologies, best practices and the latest technologies designed for proactive strategies that can be used for reducing the IT security risks and meeting the new security challenges. Well, I decided to write this blog inspired by Gartner's information security model. Infrastructure Protection The technology infrastructure is a fundamental to security and it must be fundamentally secure. Enterprises must prevent and limit damage to their business operations by deploying policies, processes, and technologies to detect and block attacks – both internal and external. We endeavour to minimize the vulnerabilities that enable attacks. The enterprise threat environment is changing rapidly, as are the approaches, applications, and technologies enterprises use to engage customers and partners. Therefore, the strategies must change with them. I believe the right approach is to focus on the processes, technologies, and services needed to protect data, app...