Join Us at the Premium Infocomm Security Conference Established in Asia!

September 23-25, 2014 – Suntec Singapore Int. Convention & Exhibition Center – Join us at Booths G28A, G27 and H27A

The Ministry of Home Affairs, Singapore, is proud to present the 23rd GovernmentWare (GovWare) conference & exhibition event. This annual event will be held from 23 to 25 September 2014 at the Suntec Singapore International Convention & Exhibition Centre.

The theme of this year’s conference is: “Strengthening The Cyber Security Ecosystem”.

An effective cyber security ecosystem requires not only the continual development of efficient cyber defence processes and technologies, but also a close collaboration between the public and private sectors. The effectiveness and resilience of this ecosystem, however, can be hampered by the cyber threats in today’s connected cyber world.

As cyber attacks become increasingly sophisticated, complex and difficult to detect, advanced cyber solutions that enable seamless security processes are essential. It is also no longer feasible for a single entity to rely on its own capabilities to defend against such cyber attacks. There is a crucial need for the various entities in the cyber ecosystem to work together to tackle the challenge.

Accordingly, the Government, the academia and industry partners have been urged to develop a close partnership which will enable such initiatives and measures as the sharing information, the development of innovative cyber solutions, the training of the next generation of cyber security professionals and the establishment of local operational or research facilities. These and other collaborative efforts of all stakeholders will aid in the shaping of a cyber security ecosystem that is both robust and vibrant.

Come join us at GovWare 2014 as we explore how we can work together to enhance the resilience of our cyber security ecosystem to create a safer cyber space for all.

Banking Vietnam, organized by State Bank of Vietnam, Vietnam Banks Association and IDG Vietnam is the largest and most influential annual banking conference and expo in Vietnam. On behalf of organizers, we are pleased to invite you to participate in Banking Vietnam 2014 on 20-22 May 2014 at Melia Hotel, Hanoi to enjoy the latest excitements in Banking trends and IT solutions. With the 17th organization, Banking Vietnam is the most prestigious annual banking conference and exposition in Vietnam. With the participation and strong supports from the State Bank of Vietnam’s government leaders, Banking Vietnam has gained enormous interest and been marked as the “must-attend” conferences by bankers’ community in Vietnam. This year, featuring the theme “Innovative Banking: Building Trust and Customer Engagement” , the 17th Banking Vietnam 2014 hopes to bring in the latest insights that enable audience to stay on top of current development, update technology solutions to enjoy higher satisfaction and loyalty from customers while  improving scalability and agility in banking system. Together with the conference, the exhibition will excite you with the showcase of newest technologies and products within the banking field and brings unique access to 400 CIOs, CSOs, IT Directors – Key decision makers for IT Purchasing.

Speaker – Mike Tan – Founder and Director of DT Asia group

Mike graduated from University of Alberta, Canada in 1989 with a degree in Computer Engineering. He did R&D work for his university and the Singapore Defence Science Organization before working the next 15 years for technology giants Hewlett-Packard and Dell. Since 2007, Mike has founded various business start-ups. DT Asia was created as a value added distribution for best-in-class information leakage protection service and solutions for government and financial institutions across Asia. DT technology partners include leading-edge security companies from USA, Israel, Hungary, Finland and South Korea .

Topic – How Top Government Organizations and Global Technology Companies Fight Advanced Cyber Threats

Dear Valuable Customers,

Data Terminator (DT) is an Information Leakage Protection Specialist in providing solution and services that secure data at rest, data in motion as well as data in use.

DT’s new and innovative products and services include:

SSH CryptoAuditor provides control, monitor and audit of privilege user access to mission critical servers and other network devices. It deploy transparently and independently from the Client/Server environment, while minimizing the impact on network architecture.

Enterprise Fraud Management (EFM) is an enterprise solution to enforce corporate security policies by detecting security breaches and exceptions.

NSA certified Equipment and Services for all Data End of Life management

ISO Certified professional services for All-in-One asset declassification
For more details, please visit https://data-terminator.com

Nearly every major network environment today – including governments, large enterprises and financial institutions – uses a version of the Secure Shell data-in-transit protocol, to protect data as it moves throughout the network and allow for administrators to manage systems remotely.

Secure Shell works by creating an encryption key pair – one key for the user’s machine, and the other key for the server – while encrypting the data that is transmitted between those two keys. Organisations use Secure Shell to encrypt everything from logins to financial data, health records and other personally-identifiable information. While Secure Shell keys protect highly sensitive information, organisations have been astonishingly indifferent at managing the creation, location and access of Secure Shell keys giving access to critical assets.

Many organisations are unable to control the creation quantity and location of keys in the network; they are leaving themselves open to security breaches and noncompliance with international regulations including Payment Card Industry Data Security Standard (PCI-DSS), Sarbanes-Oxley Act (SOX), as well as Singapore standard such as Monetary Authority of Singapore (MAS). Organisations may also be infringing upon other security policies, including those mandated by their customers.

Attacking key-based access network
Having thousands to millions of these keys is common for the majority of enterprises, governments and financial institutions worldwide. However, most of them are still using manual processes for generating, configuring and deploying the Secure Shell keys. Over time, this results in the uncontrolled proliferation of authentication keys, with little to no visibility into what each key does. A malicious actor, that gains access to a private key, can mimic an authorized user and access sensitive information with impunity.

Network breaches are commonplace as attacks become more prevalent and sophisticated. Implementing Secure Shell keys as an attack vector in a virus is fairly simple, requiring only a few hundred lines of code. Once a virus gains successful entry, it can use improperly managed Secure Shell keys to spread from server to server.

In fact, key-based access networks are so tightly woven that it is highly likely that a successful attack will infect virtually all servers within an organisation, particularly if the virus also uses other attack vectors to elevate privileges to “root” after breaching a server. With so many keys being distributed, odds are the virus will corrupt nearly all servers in a matter of seconds to minutes, including disaster recovery and backup machines that are usually also managed using such keys.

Under the worst circumstances, a virus using numerous attack vectors could spread Internet-wide, quickly and, merged with destruction technologies, could destroy immense amounts of data.

Time to take pivotal steps

Taking the steps to address Secure Shell key mismanagement will require proper support and endorsement within the organisation itself. The core of the remediation project is comprised of multiple steps:

– Automating key setups and key removals; eliminating manual work, human errors, and reducing the number of administrators from several hundred to virtually none.
– Managing what commands can be executed using the key and where the key execution can happen.
– Requiring proper processes for all key setups and other key operations.
– Monitoring the environment in order to establish which keys are actually used and removing keys that are no longer in use.
– Rotating keys, i.e., changing every authorised key (and corresponding identity keys) regularly, so that any compromised (copied) keys cease to work.
– Identifying all current trust-relationships (who has access to what).

Going forward

Today a considerable portion of the global financial institutes, Fortune 500 and many major government agencies continue to operate out of compliance, and are unknowingly facing major security threats from hackers or rogue employees. Best practices, such as the ones identified above, will position organisations to prepare for security threats and new compliance mandates before they occur.

In addition to IT involvement, executive management needs to step-in to protect the company from neglecting any compliance regulations that could bring about liability; and make it a priority to ensure that SSH user keys are properly managed in their organisations.

Tommi Lampila is Vice President, APAC, SSH Communications Security.

Cost-Effective Controls for Compliance

The Technology Risk Management Guidelines, published by the Monetary Authority of Singapore, present best practices for financial institutions to establish a technology risk management framework and to strengthen system security.

This white paper will examine the guidelines, highlight particularly significant and challenging requirements found within, and propose cost-effective solution approaches to addressing these.

Examples of available security solutions offered by SSH Communications Security will be presented in each section. Suggestions for further development of the guidelines will also be proposed.

Download a copy today!

Network World – The Secure Shell (SSH) cryptographic network protocol that’s supported in software for server authentication and machine-to-machine communications is headed for a significant update.

“There will be a new version of SSH,” says Tatu Ylonen, CEO of SSH Communications Security, pointing to the IETF draft document that’s recently been made available for public review. Co-authored with others, including NIST computer scientist Murugiah Souppaya, this third version of SSH has a focus on key management and could be set by early next year.

[ BACKGROUND: Tatu Ylonen, father of SSH, says ‘security is getting worse’ ]

Though Ylonen, whose SSH protocol originated back in 1995, said the new version could take a couple of years to catch on, so he’s pushing for backward compatibility. The last major version, SSH-2, emerged in 2006.

The 58-page IETF draft document, “Managing SSH Keys for Automated Access – Current Recommended Practice,” was published in April and is out for review until October. The document focuses on key management, Ylonen says, in an effort to eliminate now common audit and compliance problems related to SSH.

“There’s no proper tracking of what key exists,” Ylonen says about the situations he sees in many organizations.

The envisioned SSH standard provides guidelines for “discovering, remediating, and continuously managing SSH user keys and other authentication credentials.”

 

There’s no proper tracking of what [SSH] key exists.”

— Tatu Ylonen, CEO, SSH Communications Security

The IETF draft standard describes a process “for discovering who has access to what, bringing an existing IT environment under control with respect to automated access and SSH keys.” It says “the process includes moving authorized keys to protected locations, removing unused keys, associating authorized keys with a business process or application and removing keys for which no valid purpose can be found, rotating existing keys, restricting what can be done with each authorized key, and establishing an approval process for new authorized keys.” It’s all part of what’s supposed to be continuous monitoring and authorized key setup.

Ylonen acknowledges this is not necessarily the practice today and that there’s often an unfortunate state of disorder in SSH key usage that threatens the fundamental security of the assets the protocol is supposed to protect in the enterprise.

His company, SSH Communications Security, next month intends to make available a free key discovery tool that would allow the user to collect SSH key information throughout its IT environment in order to gain an assessment of risk exposure. Called SSH Risk Advisor, this tool is expected to be able to find out where SSH is being used and the SSH keys that may have proliferated.

In work being done for some larger customers, “we’re finding there are more keys than keys to accounts,” Ylonen notes. SSH Communications Security is observing instances in its customer base where mismanagement of keys has spawned literally hundreds of thousands of SSH keys, but it’s unclear how many are really supposed to be in use. Cleaning up the problem and devising new controls can be a mammoth — and expensive — task, he points out. SSH Communications Security itself is focusing increased product development on key management, for example coming up with SSH Universal Key Manager.

But Ylonen says the free SSH Risk Assessor tool is intended to make it possible for enterprises using SSH keys for secure access to get a picture of what might be out-of-control SSH key proliferation. Cleaning up the mess is another matter.

Source: http://www.networkworld.com/news/2013/040913-ssh-ylonen-268548.html

SSH Communications Security whose headquarters is in Helsinki, Finland, launches its new product “CryptoAuditor” in Singapore on 24 September 2012.  The company has more than 3,000 customers worldwide including service providers and financial institutions and Singapore is the first South-east Asian country to launch the company’s “CryptoAuditor”, a product which is able to audit and review encrypted data and monitor privileged users activities even in encrypted environments.  The article noted Mr. Tommi’s comments that CryptoAuditor is able to provide a fully transparent auditing solution and strong data-in-transit security that requires no changes to existing network architecture.  It also noted Mr. Ricky’s comments that one of the benefits of the CryptoAuditor is that it can be easily managed through a central management system that has a audit trail storage where activities can be replayed or monitored in real time and therefore reduces the risk of data history being tampered by privileged or external users.