Member Login

E-mail:    Password:  




 TitleDate AddedCompany
whitepaper IT Compliance Benchmark Report, 20062006-09-12 12:24:44 Symantec
  Download this research report from Symantec to read the results of a survey on IT compliance practices in large organizations representing an array of industries, including government agencies. The purpose of the benchmark survey, which was conducted by SecurityCompliance.com from December 2005 through March 2006, was to establish industry norms for compliance-related activities based on the results of real-world regulatory audits. This resulting report classifies organizations that perform above and below the defined norms as "leaders" and "laggards" and teases out the traits that separate them. The takeaway is a list of five key actions that can improve compliance results in most any organization.

  
whitepaper Placing the BlackBerry Enterprise Solution in a Segmented Network: BlackBerry Enterprise Server Version 4.0 and Later2006-09-06 01:00:12 Research In Motion
  Using a firewall, a person can separate a network or LAN into multiple components to create segmented network architecture. The firewall blocks data that is not destined for a particular segment, and might block all protocol ports except those that that segment specifically requires. Thus each segment contains filtered and isolated network traffic, which might improve the security and performance of the network. A particular department or a specific group of servers in an organization can use a segment of the corporate LAN while a bridge, router, or switch separates that segment from the rest of the corporate LAN. If the corporate security policies enforce the use of segmented network architecture, one can place the BlackBerry Enterprise Solution components in network segments.   
whitepaper Cisco IOS SSL VPN Gateways and Contexts2006-11-01 01:00:29 Cisco Systems
  This paper provides configuration guidance for users of Cisco IOS SSL VPN. This feature is designed to terminate SSL VPN connections on Cisco IOS Software-based routers (1800, 2800, 3700, 3800, 7200, and 7301). SSL VPN is comparable to and complements the popular IP security (IPsec) remote-access VPN. Basically, the paper looks at how the WebVPN gateway is used and applied with the context. It also looks at how each setup is used from the end-user perspective. The paper discusses some of the configuration concepts and usage. The gateway and context are the two main configuration modes for a Cisco IOS SSL VPN service.   
whitepaper Cache-Collision Timing Attacks Against AES2006-09-05 01:00:13 Microsoft
  This paper describes several novel timing attacks against the common table-driven software implementation of the AES cipher. The authors define a general attack strategy using a simplified model of the cache to predict timing variation due to cache-collisions in the sequence of lookups performed by the encryption. The attacks presented should be applicable to most high-speed software AES implementations and computing platforms, the authors have implemented them against OpenSSL v. 0.9.8.(a) running on Pentium III, Pentium IV Xeon, and UltraSPARC III+ machines. While the task of defending AES against all timing attacks is challenging, a small patch can significantly reduce the vulnerability to these specific attacks with no performance penalty.   
whitepaper BEA WebLogic Workshop at Work Supporting Real Business Initiatives2006-07-04 05:22:05 BEA Systems
  HP is a leading global provider of technology products, solutions, and services to consumers and businesses. Facing fierce competition from its rivals, HP understands that providing superior service is critical to building and maintaining customer loyalty. HP prides itself on the expertise and professionalism of its consultants, customer service representatives, and sales people. Customers must feel comfortable and confident interacting with HP via the Internet or any other channel. The challenge was to develop reusable components that can be shared by multiple e-commerce applications. After deciding to build in a J2EE environment, HP brought in BEA WebLogic Workshop from trusted technology partner BEA.   
whitepaper Demystifying the PCI Data Security Standard for Merchants2006-07-31 11:42:30 ComplyGuard Networks
  The Payment Card Industry Data Security Standard (PCI DSS) is a set of security practices set forth by American Express, Discover, Japan Central Bank, MasterCard, and VISA to protect cardholder data. It is an industry-established policy requiring compliance by all merchants and service providers that store, process, or transmit cardholder data. This white paper from ComplyGuard Networks explains what the specific requirements of the PCI DSS mean for merchants.

The PCI DSS's special requirements for service providers are detailed in the companion white paper, "The PCI Data Security Standard for Service Providers Demystified." 		  
whitepaper Improving IT Compliance: Guidance for Midsize Organizations2006-09-12 12:24:44 Symantec
  The results are in on the compliance efforts of companies boasting annual revenues of $50 to $999 million, and there's definitely room for improvement, especially at the middle and top of that bracket. So says this insightful research report from Symantec, which presents the top ten deficiencies in controls and procedures being cited in today's midsize organizations. The paper also details three critical IT compliance success factors that can help you overcome those common deficiencies and improve your audit results.

  
whitepaper Java XML Digital Signatures2006-09-27 01:00:21 Sun Microsystems
  Extensible Markup Language (XML) technology is now an integral part of web-based business applications. These applications require a fundamentally sound and secure infrastructure to meet the security requirements of confidentiality, endpoint authentication, message integrity, and nonrepudiation. XML signature, XML encryption, XML Key Management Specification (XKMS), Security Assertion Markup Language (SAML), and XML Access Control Markup Language (XACML) are the XML security standards that define XML vocabularies and processing rules to meet these security requirements. This paper provides an introduction to XML digital signatures and to the Java XML Digital Signatures APIs (JSR 105).   
whitepaper Security Annotations and Authorization in GlassFish and the Java EE 5 SDK2006-09-27 01:00:21 Sun Microsystems
  Security is very important in the enterprise environment. In the Java EE 5 / GlassFish environment, one can achieve security using Transport Level Security (TLS) / Secure Sockets Layer (SSL) technologies, authentication and authorization, and Message Level Security (for Web Services in GlassFish only). This paper discusses authentication and authorization, and discusses how to set up the SSL environment in both clients and servers for Enterprise JavaBeans and Web Services.   
whitepaper The Design of Efficient Internetwork Authentication for Ubiquitous Wireless Communications2006-06-21 01:00:38 University of Maryland
  The security problem is one of the major challenges in internetworking. To date, most research on internetwork authentication has focused on centralized authentication approaches, where the home network participates in each authentication process. For high latency between the home and visiting networks, such approaches tend to be inefficient. This paper describes chained authentication, which requires collaboration between adjacent networks without involvement of the home network. After categorizing chained protocols, the paper proposes a novel design of chained authentication methods under 3G-WLAN internetworking.