NSA - Security-Enhanced Linux.
As part of its Information Assurance mission, the National Security Agency (NSA) has long been involved with the computer security research community in investigating a wide range of computer security topics including operating system security. Recognizing the critical role of operating system security mechanisms in supporting security at higher levels, researchers from the NSA's Information Assurance Research Group have been investigating an architecture that can provide the necessary security functionality in a manner that can meet the security needs of a wide range of computing environments.
End systems must be able to enforce the separation of information based on confidentiality and integrity requirements to provide system security. Operating system security mechanisms are the foundation for ensuring such separation. Unfortunately, existing mainstream operating systems lack the critical security feature required for enforcing separation: mandatory access control. As a consequence, application security mechanisms are vulnerable to tampering and bypass, and malicious or flawed applications can easily cause failures in system security.
freshmeat.net: NSA Security-enhanced Linux 2003081307.
The SELinux module has been merged into the mainline kernel as of 2.6.0-test3. This release includes new kernel patches based on the 2.6.0-test3 kernel and a backport of the 2.6 SELinux module to the 2.4.21 kernel. The new API is consistent between 2.4 and 2.6. The old 2.4 API and user-space utilities are no longer actively maintained. There have been a number of bug fixes and cleanups to the library and utilities, as well as new contributions to the example policy.
Slashdot | "Ask Slashdot" - Slashdot | Can Web Based VPN Solutions Do It All?
Bingo Foo asks: "My company is in the process of reviewing replacements to our existing multi-platform VPN, which has now been discontinued. I was under the impression that every major vendor's OS ships with a VPN configuration solution. What gives? Are these not standard enough? Are they not secure enough? not flexible enough? Regardless, our IT department is leaning toward a clientless, web-based solution, which frankly sounds too good to be true. Can simply directing your browser at the portal allow X11, NFS, SMB, AFP, ssh, etc. transparently through the firewall? Anyone have experience with Neoteris and their VPN?"
World-Check.
KYC compliance database High Risk people and entities
[ ... ]
World-Check is a database service that tracks potential high-risk financial customers, including money launderers, terrorists and political figures, among numerous other high-risk categories. World-Check's value proposition is two-fold. To begin, we have a global network of researchers and technology solely committed to building upon our database. Our work is never complete. Our database grows literally by the day as news and information from around the world is collected, analysed and processed. Our operations are global, and our data coverage extends to over 234 countries and territories.
Our ultimate value proposition, however, has nothing to do with the size of our database. Rather, our true value extends into what we do with this data. World-Check's dedicated editorial team collects and analyses this data. What the client gets is detailed profiles on each entity, where the essential pieces of information are identified and isolated. At a glance, you will find aliases, alternative name spellings, locations, reported associates of each entity, a case synopsis and hyperlinked sources for data verification. There are no cryptic source references. Nor is there raw data that requires significant further research. World-Check does the legwork, from finding the intelligence data to analysing it -- you simply make the decision.
A little something I found when looking at the ads that Google's AdSense is putting on Privacy Digest
C-SPAN2 - C-SPAN2 - 03:54 pm Eastern - House Committee Unsolicited Electronic Mail.
Program ID 177323
Judiciary, Crime, Terrorism & Homeland Security
Howard Coble , R, North Carolina
Jerry Kilgore , Virginia
Witnesses testified about proposed legislation to regulate unsolicited commercial electronic mail known as spam. Among the issues they addressed were ways to allow legitimate commercial uses of the Internet, methods by which spam is delivered, enforcement of regulations, and potential penalties for violations of any new rules.
Accountingweb.com, IN - Corporate Executives Get Help With Security and Privacy Strategy.
A joint paper released by Canadian Information and Privacy Commissioner Ann Cavoukian and Deloitte & Touche LLP, provides corporate executives with suggestions for developing strategies for information security and privacy protection.
The Security-Privacy Paradox: Issues, Misconceptions and Strategies (ed. Link is a PDF file) examines the complex and often misunderstood relationship between the disciplines of information security and privacy protection.
"The evolution of the computer from a passive, mechanical record-keeper to an interactive, networked transaction manager has dramatically increased the volume and variety of personally identifiable information collected by organizations," said Commissioner Cavoukian. "This capability for high-speed, high-volume processing and dissemination of personal information creates the potential for substantial risks - as well as large-scale opportunities - associated with information security and privacy protection. However, you must address both - never just one. While information security and privacy do overlap, at times they may appear to contradict. In preserving one alone, companies can do serious damage to the other."
San Jose Business Journal, CA - Court backs Internet firm in privacy case.
Metrosplash.com Inc., Lycos Inc. and Matchmaker.com Inc., which operated an Internet dating service under the name Matchmaker, are not liable for the invasion of privacy and identity theft of television star Christianne Carafano, who acts under the name Chase Masterson in television programs such as "Star Trek: Deep Space Nine," and "General Hospital," according to the Ninth U.S. Circuit Court of Appeals in San Francisco.
Critical information about Ms. Carafano's home address, movie credits, and the e-mail address that revealed her phone number were transmitted unaltered to profile viewers using Matchmaker. The information had been posted without her knowledge by someone in Berlin.
San Francisco Chronicle, CA - Editorial - Populist revolt lifts privacy bill.
Sacramento is obviously feeling the heat of a populist revolt. An issue that has proved intractable for four years -- legislation to protect consumers' financial privacy -- is about to get wired for fast passage in the next week.
Representatives of major financial institutions are scheduled to announce their support for privacy legislation by Sen. Jackie Speier, D-Hillsborough, at a Capitol news conference today. The measure is almost identical to SB1, which the industry had fought so hard to defeat in an Assembly committee in June. Gov. Gray Davis, who had endorsed SB1, has listed resurrection of financial privacy as one of his top priorities.
Speier said "all the core principles are intact" in the latest version, which would give Californians control of the secondary use of their personal financial information. Banks, brokerages and insurance companies would be required to obtain customer permission before selling account balances, spending profiles or other sensitive data to telemarketers and other third parties. Consumers would also gain a limited right to stop some information sharing among affiliates.
silicon.com - Gillette slams privacy concerns over RFID tracking.
In-store tags may yet prove to be the best a LAN can get
[ ... ]
But privacy groups started protesting outside the Tesco store when it emerged the supermarket was automatically taking photographs of shoppers when they picked the blades up off the shelf and when they left the shop with any tagged product.
US-based group Consumers Against Supermarket Privacy Invasion and Numbering (CASPIAN) is also urging a worldwide boycott against Gillette over the tagging concerns.
Caspian founder and director Katherine Albrecht said: "We want to send a clear message to Gillette and other companies that consumers will not tolerate being spied on through the products they buy."
But Gillette has hit back at the "misleading" claims, saying it only wants to use the RFID tags to improve the efficiency of its supply chain. The chips, when inserted into products, emit radio signals that allow them to be tracked.
Gillette spokesman Paul Fox told silicon.com: "Our intention is very much pallet and case application within our supply chain. We have never nor do we have any intention to track, photograph or videotape consumers."
Tesco's Cambridge trial finished at the end of July and it is now running a pilot with RFID tags in DVDs at its Sandhurst store.
A Tesco spokesman said the photographing of consumers was just part of a range of uses the supermarket chain is looking at for the tags.
The Globe and Mail, Canada -The Globe and Mail.
A customer calls your company and a call-centre representative uses caller ID to pop up her electronic file and greet her by name. Bingo! The customer summons you to a closed-door review with the Privacy Commissioner of Canada.
She charges you with violating her privacy. She didn't identify herself on the call and had an unlisted number, so she assumed her identity would be anonymous. And her customer file was irrelevant: She had sought only general information when she phoned. You say you were just trying to provide good service. Your policy is that phone reps must be sure of a caller's identity before giving out confidential information. In this case, your phone rep only mentioned the customer's name.
Verdict: You lose. The commissioner rules that you violated the Personal Information Protection and Electronic Documents (PIPED) Act. You neither sought nor obtained the customer's permission to collect, use and disclose her personal information. She didn't speak about her account, so the rep had no reason to call it up.
Conclusions: You failed to apply appropriate security safeguards. Any procedures you had were not followed. Your company might disclose personal information to the wrong people. Fix this problem, or next time you may land up in court or, worse, in the newspapers.
This actually happened to a major Canadian bank in 2003. Today, the PIPED act applies only to federally regulated industries, such as banks, telcos and airlines, as well as federally chartered health organizations. But on Jan. 1, nearly every organization operating in Canada must comply with it or with provincial rules that are at least as tough. So if privacy isn't gaining space on your corporate radar, you could be risking trouble -- the embarrassing departure of George Radwanski as privacy commissioner and his replacement by Robert Marleau notwithstanding.
|
