Editor's Corner:
Good reasons for the Cybersecurity Act's failure

What's New:
1. Third-party manufacturers strategy may be a risk for RIM
2. Audit says IRS could lose $21 billion to ID theft over 5 years
3. Not everyone's a big fan of Big Data
4. Secure the IT infrastructure before investing in mobile security
5. Hidden costs in the cloud

Also Noted:
Internet sales tax looms on horizon; Hackers hit Reuters; Much more...

News From The Fierce Network:
1. Is training users on security a waste of time?
2. Microsoft: Windows 8 is ready, goes RTM
3. HBO needs to learn it's content first

FierceCIO

August 6, 2012

Subscribe | Website
Refer FierceCIO to a Colleague

This week's sponsors:
OpenText
Quest Software
Quest Software
Absolute Software


This week's sponsor is OpenText.


Records Management: Safeguarding Your Company against Risk and Cost

With the explosive growth of information and the risk and cost that unmanaged content represents, OpenText Records Management offers your business a life vest against unforeseen storms. Download this white paper today.


Editor's Corner

Good reasons for the Cybersecurity Act's failure

By Caron Carlson Comment | Forward | Twitter | Facebook | LinkedIn


The latest effort by U.S. lawmakers to legislate network security fell short last week when the Cybersecurity Act of 2012 failed in a Senate procedural vote. Conventional wisdom has it that the act was killed by Republican lawmakers under pressure from the business lobby, which argued that it would have imposed new, heavy regulatory burdens at a time when companies are struggling. While this may be true, there were also a number of good reasons to reject the initiative.

The long, complicated bill, which had been significantly weakened before coming to the Senate floor last week, would have established voluntary security measures for financial firms, utilities, transportation companies and other businesses operating the nation's critical infrastructure. In return, these businesses would be given access to more government information on cyber threats.

This legislation--and several other cybersecurity bills introduced this session--took up a great deal of time and energy in Washington over the past few months. Much of the debate centered on protecting privacy rights as the government collects more and more information on citizens. Before arriving on the Senate floor, the Cybersecurity Act had been tweaked to require annual reports from the government describing the information it received, who saw it and how it was used. It also included a provision allowing citizens to sue the government for intentional violations of the law. These are important provisions and they should serve as a starting point in any similar cybersecurity bills considered in the next Congress.

One good reason for this legislation's failure was the process by which the majority party sought to get it passed. The bill did not proceed through the normal committee process and opponents were not given a chance to propose amendments.  Senate Minority Leader Mitch McConnell, R-Ky., accused the Democratic leadership of trying to "steamroll" the bill. We have seen far too many national security related laws--which tend to be rather long and complicated--over the past decade rushed through Congress, bypassing important deliberative processes. The poster child for this abuse of process, of course, is the USA Patriot Act, enacted in the wake of 9/11. In that instance, it was Sen. McConnell's party that was guilty of the steamrolling. Process matters, and the majority's use of parliamentary sleights of hand only turns Capitol Hill into a farce.

Another good reason the bill was rejected was that it focused on voluntary measures by industry, and that sounds to me like a slippery slope. Seat belts and air bags were once voluntary too. And what information, exactly, was the government going to share with businesses to motivate them to take the voluntary steps? If the government gets wind of a hacker about to take down a nuclear power plant's network, can't it pass that information along already?

Finally, the inordinate amount of fear-mongering that the bill's advocates unleashed may be the best reason to celebrate its demise. The administration sent top defense and national security officials around town to warn of a $1 trillion price tag attached to cyber attacks. They held press conferences, wrote op-eds and all but announced an imminent Armageddon. The $1 trillion figure is debatable, to say the least, and the nonprofit investigative journalism group Pro Publica did a fine job last week debunking it. As I've argued in this space before, if the government genuinely needs expanded police powers, then it needs to do a better job justifying them.

I'm all for network security, to be sure. I believe it should be a cost of doing business, even if the U.S. Chamber of Commerce disagrees. However, if the government is going to interfere in the private sector's computer systems, the legislative and executive branches must do a much better job explaining the need, protecting citizens' rights and respecting the democratic process. - Caron

Read more about: Cyber Threats

Sponsor: Quest Software

Events

> Free Expo Pass to Cloud Connect Chicago - September 10-13 - Chicago, IL
> COMPTEL PLUS Fall 2012 Convention and EXPO - October 7-10, 2012 - Gaylord Texan, Dallas, Texas
> Join state CIOs, federal agency representatives and corporate partners for the NASCIO 2012 Annual Conference - October 21-24, 2012 - San Diego, California

Marketplace

> Whitepaper: Compliance Is Easy When You Do It in Advance
> Webinar: Prepared for a Forest-Wide Active Directory Failure?
> Whitepaper: Records Management: Safeguarding Your Company against Risk and Cost
> Whitepaper: Forrester Report: Tablets Will Rule The Future Personal Computing Landscape
> EBook: Implementation Strategies for Fulfilling and Maintaining IT Compliance
> Northwestern University Master's in Information Systems

This week's sponsor is Quest Software.

Whitepaper: Active Directory Forest Disaster Recovery: What You Don't Know WILL Hurt You

A small glitch in an Active Directory (AD) domain can go undetected - and could mean disaster for your company. Are you prepared to recover your forest from backups - or how to perform a full forest recovery - if the worst should happen? In this white paper by Microsoft MVP Brian Desmond, learn how to plan for - and overcome - Active Directory disasters. Read today.

What's New

1. Third-party manufacturers strategy may be a risk for RIM

By Caron Carlson Comment | Forward | Twitter | Facebook | LinkedIn

Research in Motion, known for maintaining control over its software and hardware, might license its upcoming operating system to third-party hardware makers. The move would signify a risky reversal in strategy, but it may be the best option for the struggling vendor, given steady competition from the likes of Apple and Google, writes Austin Carr at Fast Company.

Noting that his company isn't big enough to "crank out 60 handsets a year," RIM (NASDAQ: RIMM) CEO Thorsten Heins said last week that the new operating system, BB10, may have to be licensed to manufacturers with greater economies of scale.

The possibility of RIM handing over hardware responsibility to third parties comes across as somewhat ironic given recent steps by big software companies to edge their way into the hardware business. Microsoft (NASDAQ: MSFT) announced in June that it plans to make a tablet of its own and Google (NASDAQ: GOOG) recently bought Motorola Mobility (NYSE: MMI). "Both moves signal the tech giants are moving into Apple territory," Carr writes. "Cupertino has always been committed to controlling the stack--that is, designing software and hardware together. The result has been an unprecedented streak of innovation and market dominance: iPods, iPhones, iPads."

For RIM to go the other direction means that it is "possibly sacrificing its one Apple-like advantage," Carr notes. On the other hand, third-party manufacturers may appreciate a new "agnostic" software maker in the market, given the growing competition they face from many of the same companies they license software from. Microsoft's OEMs, for example, are not necessarily thrilled about the vendor's decision to make its own tablets.

For more:
- see Austin Carr's article at Fast Company

Related Articles:
New BlackBerry Mobile Voice System supports Wi-Fi calling, broader PBX integration
BlackBerry 10 delayed until 2013
Spotlight: The ugly side of mobile security

Read more about: Research in Motion, BB10
back to top


This week's sponsor is Quest Software.

Compliance Is Easy When You Do It in Advance

Is your business reactively implementing compliance? If so, you're wasting time and money and destroying productivity. Get proactive! In this Quest white paper, see how centralized monitoring and reporting is more secure, saves money and helps you adapt and manage compliance needs today and tomorrow. Read it today.


2. Audit says IRS could lose $21 billion to ID theft over 5 years

By Caron Carlson Comment | Forward | Twitter | Facebook | LinkedIn

Identity theft could cost the U.S. Treasury up to $21 billion in the next five years alone, and that's accounting for estimated savings from newly purchased fraud control filters, reports Jeremy Kirk of IDG News Service. Despite the Internal Revenue Service's efforts to combat ID theft, it is still sending out refunds on bogus tax returns filed on behalf of deceased individuals, according to an audit by the Treasury inspector general for tax administration.

The audit found that the IRS isn't doing enough to detect fraud trends. The tax agency failed to identify 1.5 million fraudulent tax returns, at a cost of $5.2 billion, the auditors maintain. More than $8 million in potential fraud stemmed from returns sent from just five addresses. What's more, some policies and procedures are undercutting anti-fraud efforts. One example is allowing individuals to file returns in the middle of January while third parties with information connected to those returns have until March 31 to file.

The IRS, which disputes the inspector general's estimate of a $21 billion loss in five years, said it detected $6.5 billion worth of potential fraud in 938,664 fraudulent returns for 2011.

For more:
- see Jeremy Kirk's article at Computerworld

Related Articles:
Millions of Americans risk ID theft via social networks
Scammers target Georgia's business registration data

Read more about: identity theft
back to top


3. Not everyone's a big fan of Big Data

By Caron Carlson Comment | Forward | Twitter | Facebook | LinkedIn

Everyone's talking about Big Data these days, but a lot of companies aren't actually doing much about it. While the benefits of Big Data analytics sound enticing, IT leaders seem more interested in investing in ways to support new and existing business applications, improve disaster recovery and consolidate servers, reports Kevin Fogarty at InformationWeek.

There has been a barrage of surveys recently on Big Data (from McKinsey and Company, The Information Technology and Innovation Foundation, Pew Research Center's Internet and American Life Project, and TheInfoPro, to name a few), and Fogarty presents a nice roundup of them. Some studies suggest that IT and business managers have more concerns than enthusiasm about Big Data implementation. Many are not prepared to invest in what they perceive to be large, expensive modifications to their systems for collecting, storing, managing and analyzing information. 

Another concern is that employees who can really benefit from Big Data, like marketing and pricing managers, are accustomed to using spreadsheets and other programs that aren't suited to the volume of information in Big Data sets. Without enthusiasm on the part of end users, it is hard to justify the expense of a Big Data deployment.

What's more, fears about data vulnerability are dampening the zeal for Big Data projects, Fogarty notes. A survey from Quantum, a Big Data management company, found that 90 percent of IT decision makers fear losing data during disaster recovery.

For more:
- see Kevin Fogarty's article at InformationWeek

Related Articles:
Fujitsu rolls out cloud-based Big Data platform for farmers
Who's who in big data
Big data identifies the best bull in America

Read more about: TheInfoPro, surveys
back to top


4. Secure the IT infrastructure before investing in mobile security

By Caron Carlson Comment | Forward | Twitter | Facebook | LinkedIn

If the effort to secure your company's mobile devices resembles a kitten's effort to catch the light of a laser pointer, you may be getting distracted by too many moving parts without taking in the big picture. It can make good sense to step back and get a solid look at the entire IT infrastructure before trying to pinpoint mobile device problems, reports Ericka Chickowski at Dark Reading.

Much of the cutting-edge work on mobile security may be interesting, but not necessarily relevant to the typical organization trying to defend against the most pressing threats to the network. Cyber crooks aren't likely to turn their might against mobile devices right now because they are still finding plenty of success exploiting traditional IT systems, advises Marcus Carey, security researcher at Rapid7.

"Attackers are robbing people blind right now. Why would they change their attack vector?" Carey asks. "Right now it is really hard to get payloads that work (on mobile devices). So why jump to mobile, when it is harder to the nth degree, when you already have this other stuff working?"

Before spending too much time on mobile security, it may behoove the average organization to make sure it is taking care of mundane patching first. Effective antivirus programs and other means of securing desktops and laptops should still be a top priority, experts advise. Once the overall IT security framework is in order, it will be easier to add mobile security into the mix.

For more:
- see Ericka Chickowski's article at Dark Reading

Related Articles:
Keys to a successful MDM project
Banks fortify IT infrastructure for competitive edge

Read more about: Mobile Security, antivirus software
back to top


5. Hidden costs in the cloud

By Caron Carlson Comment | Forward | Twitter | Facebook | LinkedIn

It can look pretty cheap to sign up for cloud services, but the return on investment has to factor into a number of costs that aren't necessarily apparent at first glance. To get a full estimate of the cost of a cloud service, you have to consider what it will take to migrate systems, adopt to regulatory changes down the road and get locked into a specific vendor, reports Mikael Ricknas of IDG News Service.

Moving applications to a cloud provider can require a lot of redesign and reformatting. If a cloud service has to be brought back in-house, because of new regulatory requirements for example, it can take considerable resources to extract data from the provider, according to a white paper from the Information Systems Audit and Control Association.

The security requirements of a public cloud system can prove costly, while a private or hybrid cloud option may be less so. What's more, the risk of being locked in to a proprietary cloud system must also be factored into any move, notes the ISACA paper, "Calculating cloud ROI: From the customer perspective." Some of the lock-in risks could be reduced by opting for infrastructure-as-a-service rather than software-as-a-service.

For more:
- see Mikael Ricknas's article at InfoWorld

Related Articles:
Megaupload case spotlights data ownership issues in the cloud
IaaS requires heavy work by in-house IT teams
Washington Post CTO: Cloud providers should offer an easier way out

Read more about: white paper
back to top


Also Noted

This week's sponsor is Absolute Software.

Forrester's research looks at projected buying trends for tablets and other devices through 2017 and discusses frames - a new form of PC which, when used with a tablet, could reinvent the PC experience. Forrester also provides guidance for architects and apps managers in terms of preparing for the new PC architecture. Download this Whitepaper now!


> Internet sales tax looms on horizon. Article (NBC)
> Who's "freaking out" about Big Data? Article (InformationWeek)
> Hackers hit Reuters, post fake interview. Article (ZDNet)
> Senators strike down cybersecurity bill. Article (Washington Post)
> Lead like the commander of a ship. Article (CIO Insight)

And Finally... Driver texts "I need to quit texting," then crashes into ditch. Article (MSNBC)

Events

> Free Expo Pass to Cloud Connect Chicago - September 10-13 - Chicago, IL

Cloud Connect provides you with real-world examples and deep insights into the new world of cloud computing. Gain insight from industry leaders Google, HP, Rackspace, and IBM on how they are tackling the latest cloud topics. Register now with Code FIERCE to save 25% or claim a free Expo Pass.

> COMPTEL PLUS Fall 2012 Convention and EXPO - October 7-10, 2012 - Gaylord Texan, Dallas, Texas

COMPTEL PLUS Fall 2012 Convention and EXPO, October 7-10, 2012, Gaylord Texan, Dallas, Texas

> Join state CIOs, federal agency representatives and corporate partners for the NASCIO 2012 Annual Conference - October 21-24, 2012 - San Diego, California

Join state CIOs, federal agency representatives and corporate partners for a conference centered on policy issues, trends, best practices and information technology issues that affect the public and private sectors. Attendees can map strategies, develop positions and act responsibly for the benefit of all involved. Register today!

Marketplace

> Whitepaper: Compliance Is Easy When You Do It in Advance

Is your business reactively implementing compliance? If so, you're wasting time and money and destroying productivity. Get proactive! In this Quest white paper, see how centralized monitoring and reporting is more secure, saves money and helps you adapt and manage compliance needs today and tomorrow. Read it today.

> Webinar: Prepared for a Forest-Wide Active Directory Failure?

This Quest Software webcast explores the causes of a forest-wide AD failure, case studies on actual forest disasters, and how being proactive can help prepare - or possibly avoid - this catastrophe. Watch today.

> Whitepaper: Records Management: Safeguarding Your Company against Risk and Cost

With the explosive growth of information and the risk and cost that unmanaged content represents, OpenText Records Management offers your business a life vest against unforeseen storms. Download this white paper today.

> Whitepaper: Forrester Report: Tablets Will Rule The Future Personal Computing Landscape

Forrester's research looks at projected buying trends for tablets and other devices through 2017 and discusses frames - a new form of PC which, when used with a tablet, could reinvent the PC experience. Forrester also provides guidance for architects and apps managers in terms of preparing for the new PC architecture. Download this Whitepaper now!

> EBook: Implementation Strategies for Fulfilling and Maintaining IT Compliance

IT compliance is mandatory for your business – but it doesn’t have to be difficult, and when properly controlled is a boon for your company. In this four-part eBook, see how the many parts of IT compliance can be effectively managed throughout the business. Get it today.

> Northwestern University Master's in Information Systems

Advance your career in IT management or move into an IT management career with the Master of Science in Information Systems program at Northwestern University. Take classes on-campus or online and learn the most current information systems trends and strategies in the marketplace. Learn more.



Refer FierceCIO to a Colleague

Contact Us

Editor: Caron Carlson. VP sales and business development: Jack Fordi. Publisher: Ron Lichtinger.

Advertise

General advertising: Jack Fordi. Press releases: Caron Carlson. Request a media kit.

Explore Our Network

You may enjoy these publications from FierceMarkets: