“We have a long way to go,” acknowledges Heartland CEO Bob Carr, pointing out the so-called E3 payment terminals, intended for small-to-midsize customers, are but the first step, “with more advanced technologies coming in the summer” intended for use between Heartland’s network and much larger merchants that would require more back-end integration into processing systems. “We’re not ready to help all of them yet,” he acknowledges.

There is as of yet no end-to-end encryption requirement for debit- and credit-card processing, though the Payment Card Industry (PCI) Security Standards Council, which sets technical standards used by payment processors and merchants, is expected to weigh in on that topic in its upcoming PCI standard this October.

Unwilling to delay action after last year’s devastating discovery of a data breach that has so far cost it well over $100 million in fines and associated costs, Heartland has spearheaded its own multi-million-dollar end-to-end encryption technology effort to keep cybercriminals at bay. (Hacker Albert Gonzalez was caught and confessed to hacking Heartland’s processing network and much more, and this March was sentenced to 20 years in prison.

“Every single breach I know of wouldn’t have happened if our end-to-end encryption solution had been there,” Carr says. He believes Heartland is the first to come out with a commercial deployment of end-to-end encryption with merchants.

Carr says the definition of end-to-end encryption may end up varying, but in the case of Heartland, it means protecting card data, particularly the track data, as it’s being swiped at the merchant to the entry point to Heartland’s network, and encrypted on through Heartland’s network. However, this encryption now stops at the card brand point, such as Visa and MasterCard, and isn’t encrypted on through to the banking points.

Carr thinks the most vulnerable points that hackers will try to exploit are in the interconnections between merchant and payments processor, but he acknowledges that as the industry evolves to better protect these routes, hackers will undoubtedly look for the weakest link in the chain.

The E3 terminals, built by Voltage Security and Uniform Industrial Corp., were custom ordered by Heartland, which isn’t requiring its merchants to use them, but strongly recommending them.

“They do have to buy the devices,” Carr says, noting they range between $300 to $500, which Heartland will finance for six months if merchants have cash-flow issues. But one incentive for using E3 is a guarantee from Heartland that if merchants using E3 are breached, Heartland will cover fines and forensic costs related to any breach tied to the stand-alone terminals. Heartland is also offering free help to smaller merchants in filling out PCI standard conformance forms, something that can be technically bewildering to them.

One looming issue in end-to-end encryption is interoperability if the industry adopts more robust processes for protection through encryption. But Carr is optimistic the industry will meet the challenge, saying the PCI Security Standards Council “is listening hard and being responsive.”

Source

Trustwave will continue to sell and support Breach Security’s Web application firewall, which is designed to filter out attacks that could give hackers access to personal customer data and to an enterprise’s internal systems, the company said in a press release. Trustwave will also add that firewall technology to the suite of programs offered through its SpiderLabs unit. The suite includes penetration testing, secure code review, incident response and software development training.

A Web application firewall combined with application penetration testing can offer greater protection from Web-based attacks such as SQL injection, which is used to exploit vulnerabilities in the database layer of an application, Trustwave said.

The acquisition continues a buying spree by Trustwave, based in Chicago, which sells products and services for compliance as well as security. Last September it bought Vericept, a vendor of data-loss prevention (DLP) technology, with an eye to better serving companies that need to comply with the payment card industry’s Data Security Standard. Trustwave said it would continue to market Vericept’s standalone DLP products. In January, Trustwave acquired encryption vendor BitArmor. Terms were not disclosed for either of those deals.

Technology mergers and acquisitions declined during the recession but are now on the upswing. Security companies are involved in the trend, with McAfee announcing last month that it is acquiring Trust Digital.

Source

IT is an integral factor in some of the Obama administration’s near-term priorities, which will bolster growth in federal IT spending even though spending in this sector remains largely conservative, according to the according to the Federal Information Technology Market 2010-2015 report released by INPUT.

Administration priorities to improve how the government engages both with the public and among agencies hinge on technology, as do cybersecurity measures and a focus to increase program oversight and performance.

The government also is eyeing technology to help reduce energy costs, according to the report, which was released on the same day as another one analyzing the Obama administration’s plan to consolidate data centers to achieve this goal.

But even as the White House invests in technology to improve transparency and citizen engagement, it lacks the personnel necessary to achieve those goals. This means there will still be plenty of contracts awarded to IT professionals serving the federal government, according to the report. This is counter to some concerns among federal contractors, who feared the government would tap internal professionals for the job.

“The criticality of IT to government operations and priorities, as well as the gap in federal IT expertise, suggests that IT spending will continue with modest growth,” INPUT analyst John Slye said in a press statement. He co-authored the report with analyst Deniece Peterson.

INPUT surveyed 119 people via telephone interviews in May to gather research for the report. Of those surveyed, 66 are federal IT and program managers and 53 are executives in various government-related industries.

Researchers also asked government IT professionals which technologies will get more attention in the next five years. Not surprisingly, cloud computing topped the list, with 67 percent of respondents saying it will receive new or increased focus. IT security was close behind, with 62 percent of those surveyed acknowledging a greater focus there.

Virtualization (48 percent), IT modernization (38 percent), infrastructure consolidation (35 percent) and telework (26 percent) also are priorities for the government sector, according to the report.

Source

“We are witnessing a once-in-a-generation opportunity to make world-class IT infrastructure available to the masses,” said Sunil Dhaliwal a General Partner at Battery Ventures. “While legacy vendors have made billions solving discrete automation problems for very large organizations, the future belongs to those that can deliver simple, scalable automation to any IT user, regardless of their size or sophistication. As a founding investor in data center automation pioneer BladeLogic, we understand the enormity of this shift, and are tremendously excited to support Opscode in making it a reality. They have the team, the technology and the market momentum needed to truly democratize infrastructure management.”

Opscodeʼs technology enables companies of all sizes to build, scale, and manage world-class, fully automated infrastructures based on community best practices and expertise. In 2009, Opscode released “Chef”, an open source systems integration framework. Since this time, more than 150 individuals and 25 companies including Rackspace, RightScale and the Springsource division of VMware have signed on to contribute to the project, making it the worldʼs largest open source configuration management project based on the number contributors.

Using Chef, software developers and engineers are able to manage large-scale server and application deployments by writing code, rather than running commands by hand. Chef is currently in production at top websites, including 37Signals, Etsy, IGN Entertainment, Scribd, Wikia, and White Pages.

“In just a very short period of time, Opscode has attracted some of the brightest minds in infrastructure. These individuals have been responsible for managing some of the worldʼs largest and most complex computing environments and it is from this collective expertise that the idea for Opscode was born,” Jesse Robbins, co-founder and CEO of Opscode. “We count ourselves most fortunate to have partnered with firms like Battery Ventures and Draper Fisher Jurvetson who bring a great deal more than just capital to Opscode. Most importantly, closing a round of this size lets us focus our energies squarely on helping our customers – as well as the Chef community — get the most out of their infrastructure.”

About Opscode
Opscode provides world class infrastructure automation for servers, datacenters, desktops, & the cloud. Opscode makes Chef, the open source configuration management and integration framework used by thousands of organizations to manage and scale infrastructure. Founded in 2008, Opscodeʼs management team includes experts responsible for creating and operating some of the worldʼs largest websites and cloud computing platforms. The company is privately held and headquartered in Seattle. More information can be found at www.opscode.com.

About Battery Ventures
Since 1983, Battery has been investing in technology and innovation worldwide. The firm partners with entrepreneurs and management teams across technology sectors, geographies, and stages of a companyʼs life — from start-up and expansion financing to growth equity and buyouts.

Battery has supported many breakthrough companies around the world, including: Airespace (acquired by Cisco), Akamai Technologies (NASDAQ: AKAM), BladeLogic (acquired by BMC Software), Netezza (NYSE Arca: NZ), Omniture (NASDAQ: OMTR), and ProfitLogic (acquired by Oracle). Battery currently manages more than $3B in committed capital and invests from offices in Boston, Silicon Valley and Israel. For more information, visit: www.battery.com.

Press Contact:
Robert Nachbar, Kismet Communications, 206-427-0389, rob@kismetcommunications.net
Karen Bommart, Battery Ventures, 781-478-6672, kbommart@battery.com

Source

A peer-to-peer, commonly abbreviated to P2P, is any distributed network architecture composed of participants that make a portion of their resources (such as processing power, disk storage or network bandwidth) directly available to other network participants, without the need for central coordination instances (such as servers or stable hosts).

In simple terms, P2P is software installed on your PC and others PCs that allows the sharing of data from each others computers.
Computerworld reports, “One of the more than 3,000 files discovered by the researchers was a spreadsheet containing insurance details, personally identifying information, physician names and diagnosis codes on more than 28,000 individuals. Another document contained similar data on more than 7,000 individuals. Many of the documents contained sensitive patient communications, treatment data, medical diagnoses and psychiatric evaluations. At least five files contained enough information to be classified as a major breach under current health-care breach notification rules.”

In my own research, digging through P2P networks, I’ve uncovered tax returns, student loan applications, credit reports and Social Security numbers. I’ve found family rosters which include usernames, passwords and Social Security numbers for entire families. I’ve found Christmas lists, love letters, private photos, videos, and just about anything else that can be saved as a digital file.

It’s no surprise data is still leaking. File sharing technologies are easier and more user friendly than ever. Faster broadband connections coupled with faster PCs and bigger hard drives make downloading files a snap. Insurance companies, doctor’s offices and hospitals all have computers and those computers are operated by people who like things that are free. Any bored employee who wants to listen to that song he heard on the way to work can simply download Limewire, eDonkey, BearShare, or any other P2P network. Within minutes, that song is on playing on the employee’s iPod, and his employer’s clients’ data is being shared with the world. This type of breech resulted in blueprints for President Obama’s private helicopter being leaked online.

The House Committee on Oversight and Government Reform has asked the Department of Justice and the FTC to help prevent illegal use of peer to peer networks, and in the same letter, asked what the government is doing to protect its citizens. But ultimately, it’s up to you to protect yourself.

Don’t install P2P software on your computer. If you aren’t sure whether a family member or employee may have installed P2P software, check for new, unfamiliar applications. A look at your “All Programs Menu” will show nearly every program on your computer. If you see one you don’t recognize, do an online search to see what it is you’ve found. You should also set administrative privileges to prevent the installation of new software without your knowledge.

If you must use P2P software, be sure that you don’t share your hard drive’s data. When you install and configure the software, don’t let the P2P program select data for you.

The Smartcard Alliance has released an in-depth report called “Medical Identity Theft in Healthcare.”

Source

The security appliance company is profitable and growing — its earnings last quarter were 17% higher than for the same quarter last year — but with the security appliances industry consolidating, it needs to grow faster, says Patrick Sweeney, vice president of product management for SonicWall. The company has $200 million in cash as well, he says.

If approved by shareholders, the deal will enable faster development of the company’s next big product push, called Super Massive, a jump to 10Gbit/s speeds for its unified threat management hardware with all the security features turned on, he says. “It’s important for us to grow as fast or faster than the market,” he says. “This will allow us to build a larger company a lot faster.”

Size is important because the industry is consolidating, he says, pointing to HP’s purchase of 3Com and its security devices division Tipping Point, making smaller companies more vulnerable.

As a listed company, SonicWall’s goals were constrained to ever increasing 90-day demands between fiscal reporting quarters, which limits longer term investments that can alter a company’s strategic course, he says.

SonicWall, which makes unified threat management, firewall, VPN and backup appliances as well as endpoint security, email security and antispam software, says the deal will buy out current shareholders for $11.50 per share in cash, which is 63 percent more than the stock is going for publicly. Stockholders still have to approve the deal, and that is expected by early in the fourth quarter of this year.

Source

The DOE’s small item payment process account at JPMorgan Chase was supposed to be limited to purchases of less than $500, but an oversight by officials allowed electronic transfers of any amount, according to investigators who probed the theft. The crooks were able to perpetrate the scam for more than three years because education officials didn’t bother to reconcile account statements on a regular basis.

“It is difficult to understand how the DOE accumulated years of account statements, reflecting hundreds of thousands of public dollars spent to pay bills, but did not review them,” the report, which was written by Special Commissioner of Investigation for the New York City School District, stated. “A cursory examination would have shown that the charges were not normal school expenses.”

The individual who headed the theft was Albert Attoh, who in April was sentenced to 364 days in federal prison after pleading guilty to Bank Larceny. He was also ordered to pay more than $275,000 in restitution and be on probation for two years following his release.

According to the report, Attoh provided the account and routing information to others so they could use it to pay student loans and invoices for purchases at Home Depot and other retail outlets. In return, Attoh demanded cash payments. Because DOE officials failed to block the use of electronic transfers, the account was wide open. All that was required what the account number and the bank routing number.

The scheme started in October 2003 and only came to the attention of officials in February 2007 when Chase received a tip that someone was trying to pay bills using the DOE account. In all, $644,313.69 was stolen, but $128,228.49 was eventually recovered. A PDF of the report is here.

Source

The security appliance company is profitable and growing — its earnings last quarter were 17% higher than for the same quarter last year — but with the security appliances industry consolidating, it needs to grow faster, says Patrick Sweeney, vice president of product management for SonicWall. The company has $200 million in cash as well, he says.

If approved by shareholders, the deal will enable faster development of the company’s next big product push called Super Massive, a jump to 10Gbps speeds for its unified threat management hardware with all the security features turned on, he says. “It’s important for us to grow as fast or faster than the market,” he says. “This will allow us to build a larger company a lot faster.”

Size is important because the industry is consolidating, he says, pointing to HP’s purchase of 3Com and its security devices division Tipping Point, making smaller companies more vulnerable.

As a public company, SonicWall’s goals were constrained to ever increasing 90-day demands between fiscal reporting quarters, which limits longer term investments that can alter a company’s strategic course, he says.

SonicWall, which makes unified threat management, firewall, VPN and backup appliances as well as endpoint security, e-mail security and antispam software, says the deal will buy out current shareholders for $11.50 per share in cash, which is 63% more than the stock is going for publicly. Stockholders still have to approve the deal, and that is expected by early in the fourth quarter of this year.

Thoma Bravo, which uses the tag line “buy and build” owns other high-tech assets including security management firm Attachmate, application and database-tool vendor Embarcadero Technologies and secure authentication experts Entrust.

Source

Joe Damato wrote in a blog post Tuesday that he received a promotional email from American Express encouraging him to sign up for the Daily Wish service, through which cardholders can receive hefty discounts on a limited amount of merchandise, such as computers and camcorders.

If users click on the “Sign up for Daily Wish” button, they are prompted to enter personal information, such as name, card number, security code, expiration date and billing zip code, into a pop-up box. The box includes a “This page is secure” notification link, but upon further review, Damato found this not to be the case.

The domain for the sign-up box was not using “https,” an encrypted form of information transfer, he said. Damato used the open-source packet analyzer Wireshark to confirm that the (fake) information he entered into the form was delivered in clear text back to American Express’ server.

The card company, in a tweet posted this evening EST, said it was aware of the issue and investigating.

Source

Bloomberg made his pitch Tuesday at a gathering of technology entrepreneurs, announcing the creation of a city-sponsored $22 million venture fund that will invest in promising tech companies headquartered in New York.

The city’s Economic Development Corporation will invest $3 million in the fund while FirstMark Capital, a New York-based venture capital fund will provide up to $19 million more.

The backdrop for Bloomberg’s announcement was TechCrunch Disrupt, a media and technology conference that draws tech entrepreneurs from across the country.

Bloomberg, 68, is a multibillionaire who made his fortune starting Bloomberg LP, a financial data and news company. He reminded the crowd that he was a tech pioneer long before the Internet existed and offered up some of his other high-tech credentials as well.

“Before this morning’s conference I updated my Facebook page, sent a Tweet, browsed my Digg feed and checked in at Foursquare,” he said. “I even posted a personal ad on Craigslist: Cleveland basketball star to play basketball in the Big Apple.”

It was a joking reference to the city’s efforts to woo LeBron James of the Cleveland Cavaliers.

Asked why a tech startup should choose New York over the warmer West Coast climes, Bloomberg said that venture capital funding of companies in New York was up 19 percent last year even as it fell elsewhere amid the poor economy. He said the creativity and talent in New York was unmatched anywhere.

“It’s a great place where intellectual capital is important. If you want to compete in the big pond, if you want a breadth of cultural opportunities … this is the place to come,” Bloomberg said.

He said New York should be particularly attractive to tech companies because it is “the most immigrant-friendly city in America.” He said that both the tech economy and the larger U.S. economy thrived with more immigrants, not less.

Source